From Red Hat Enterprise Linux 7 Security Technical Implementation Guide
Part of SRG-OS-000342-GPOS-00133
Associated with: CCI-001851
Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.
Verify the action the operating system takes if the disk the audit records are written to becomes full. To determine the action that takes place if the disk is full on the remote server, use the following command: # grep -i disk_full_action /etc/audisp/audisp-remote.conf disk_full_action = single To determine the action that takes place if the network connection fails, use the following command: # grep -i network_failure_action /etc/audisp/audisp-remote.conf network_failure_action = stop If the value of the "network_failure_action" option is not "syslog", "single", or "halt", or the line is commented out, this is a finding. If the value of the "disk_full_action" option is not "syslog", "single", or "halt", or the line is commented out, this is a finding.
Configure the action the operating system takes if the disk the audit records are written to becomes full. Uncomment or edit the "disk_full_action" option in "/etc/audisp/audisp-remote.conf" and set it to "syslog", "single", or "halt", such as the following line: disk_full_action = single Uncomment the "network_failure_action" option in "/etc/audisp/audisp-remote.conf" and set it to "syslog", "single", or "halt".
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer