Audispd must take appropriate action when the SUSE operating system audit storage is full.
An XCCDF Rule
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
- ID
- SV-217201r959008_rule
- Version
- SLES-12-020110
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the SUSE operating system to take the appropriate action if the audit storage is full.
Add, edit, or uncomment the "disk_full_action" option in "/etc/audisp/audisp-remote.conf". Set it to "syslog", "single" or "halt" as in the example below:
disk_full_action = syslog