Configure audispd's Plugin disk_full_action When Disk Is Full

Description

Configure the action the operating system takes if the disk the audit records are written to becomes full. Edit the file /etc/audit/audisp-remote.conf. Add or modify the following line, substituting ACTION appropriately:

disk_full_action = ACTION

Set this value to single to cause the system to switch to single user mode for corrective action. Acceptable values also include syslog and halt. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined.

Rationale

Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.