RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
An XCCDF Rule
Description
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
- ID
- SV-258158r971542_rule
- Version
- RHEL-09-653045
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure RHEL 9 to initiate an action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity by adding/modifying the following line in the /etc/audit/auditd.conf file.
admin_space_left = 5%