OpenControls Logo

STIG Viewer

STIGViewer Support

AlmaLinux OS 9 audit system must make full use of the audit storage space.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-269528ALMA-09-054360SV-269528r1050411_ruleCCI-000140medium
Description
max_log_file (size in megabytes) multiplied by num_logs must make full use of the auditd storage volume (separate to the root partition). If max_log_file_action is set to ROTATE or KEEP_LOGS then max_log_file must be set to a value that makes the most use of the storage available.
STIGDate
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide2026-02-27

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-05Response To Event Log Processing Failures
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (24) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-14(1)System Start-up
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-3(2)Centralized Management of Planned Audit Record Content
1.00
AU-4Audit Log Storage Capacity
1.00

+14 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.3.4
1.00
CCI1 mapping
CCI-000140
1.00

Details

Check Text (C-269528r1050411_chk)

Verify that AlmaLinux OS 9 is configured to make full use of the auditd storage volume when rotation is enabled, with the following command: $ grep max_log_file /etc/audit/auditd.conf max_log_file = 8 If the value of the "max_log_file" option is not sufficiently large to maximize the use of the storage volume, is commented out, or is missing, this is a finding.

Fix Text (F-73460r1049935_fix)

Configure AlmaLinux OS 9 to make full use of the auditd storage volume with rotation enabled. Add or update the following line in the "/etc/audit/auditd.conf" file to a value large enough to make efficient use of the auditd storage volume: max_log_file = 100