OpenControls Logo

STIG Viewer

STIGViewer Support

The macOS system must configure audit capacity warning.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-268468APPL-15-001030SV-268468r1034344_ruleCCI-000139medium
Description
The audit service must be configured to notify the system administrator when the amount of free disk space remaining reaches an organization-defined value. This rule ensures that the system administrator is notified in advance that action is required to free up more disk space for audit logs. Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00134
STIGDate
Apple macOS 15 (Sequoia) Security Technical Implementation Guide2026-02-06

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-05Response To Event Log Processing Failures
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (20) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(4)Automated Audit Actions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-12(1)System-wide and Time-correlated Audit Trail
1.00
AU-14(1)System Start-up
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5Response to Audit Logging Process Failures
1.00
AU-5(1)Storage Capacity Warning
1.00
AU-5(2)Real-time Alerts
1.00
AU-6(4)Central Review and Analysis
1.00

+10 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.3.4
1.00
CCI1 mapping
CCI-000139
1.00

Details

Check Text (C-268468r1034344_chk)

Verify the macOS system is configured to require a minimum of 25 percent free disk space for audit record storage with the following command: /usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control If the result is not "25", this is a finding.

Fix Text (F-72399r1034343_fix)

Configure the macOS system to require a minimum of 25 percent free disk space for audit record storage with the following command: /usr/bin/sed -i.bak 's/.*minfree.*/minfree:25/' /etc/security/audit_control; /usr/sbin/audit -s