OpenControls Logo

STIG Viewer

STIGViewer Support

DB2 must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-213720DB2X-00-007500SV-213720r879730_ruleCCI-001849medium
Description
In order to ensure sufficient storage capacity for the audit logs, the DBMS must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates that audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism. The task of allocating audit record storage capacity is usually performed during initial installation of the DBMS and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both. In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on the DBMS's ability to reuse the space formerly occupied by off-loaded records.
STIGDate
IBM DB2 V10.5 LUW Security Technical Implementation Guide2023-06-11

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-04Event Log Storage Capacity
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (14) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AU-12Audit Record Generation
1.00
AU-14(1)System Start-up
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-4Audit Log Storage Capacity
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5Response to Audit Logging Process Failures
1.00
AU-5(1)Storage Capacity Warning
1.00
AU-5(2)Real-time Alerts
1.00
AU-7Audit Record Reduction and Report Generation
1.00

+4 more (top 10 by confidence shown)

CCI1 mapping
CCI-001849
1.00

Details

Check Text (C-213720r879730_chk)

Run the following command to find the location of the audit data directory: $db2audit describe Note the location of audit data directory. Check the operating system log records find out if there has been any out of space event for that location. If there has been any out of space event for audit data directory, this is a finding. Take samples of peak database activity and measure the space utilized in the audit data directory location during that time. If the audit data directory is not sized to handle the workload between audit archiving intervals this is a finding.

Fix Text (F-14939r295210_fix)

Allocate space to the file system where the audit data directory resides.