OpenControls Logo

STIG Viewer

STIGViewer Support

The macOS system must configure audit capacity warning.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-259468APPL-14-001030SV-259468r958424_ruleCCI-000139medium
Description
The audit service must be configured to notify the system administrator when the amount of free disk space remaining reaches an organization defined value. This rule ensures that the system administrator is notified in advance that action is required to free up more disk space for audit logs. Satisfies: SRG-OS-000046-GPOS-00022,SRG-OS-000343-GPOS-00134
STIGDate
Apple macOS 14 (Sonoma) Security Technical Implementation Guide2024-12-04

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-05Response To Event Log Processing Failures
1.00
MON-05.2Event Log Storage Capacity Alerting
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (23) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(4)Automated Audit Actions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-12(1)System-wide and Time-correlated Audit Trail
1.00
AU-14(1)System Start-up
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-4Audit Log Storage Capacity
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5Response to Audit Logging Process Failures
1.00

+13 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.3.4
1.00
CCI2 mappings
CCI-000139
1.00
CCI-001855
1.00

Details

Check Text (C-259468r958424_chk)

Verify the macOS system is configured to require a minimum of 25 percent free disk space for audit record storage with the following command: /usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control If the result is not "25", this is a finding.

Fix Text (F-63115r941025_fix)

Configure the macOS system to require a minimum of 25 percent free disk space for audit record storage with the following command: /usr/bin/sed -i.bak 's/.*minfree.*/minfree:25/' /etc/security/audit_control; /usr/sbin/audit -s