AlmaLinux OS 9 audit system must make full use of the audit storage space.
An XCCDF Rule
Description
max_log_file (size in megabytes) multiplied by num_logs must make full use of the auditd storage volume (separate to the root partition). If max_log_file_action is set to ROTATE or KEEP_LOGS then max_log_file must be set to a value that makes the most use of the storage available.
- ID
- SV-269528r1050411_rule
- Version
- ALMA-09-054360
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure AlmaLinux OS 9 to make full use of the auditd storage volume with rotation enabled.
Add or update the following line in the "/etc/audit/auditd.conf" file to a value large enough to make efficient use of the auditd storage volume:
max_log_file = 100