The Photon operating system audit log must log space limit problems to syslog.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-256491 | PHTN-30-000014 | SV-256491r958424_rule | CCI-000139 | medium |
| Description | ||||
| It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000344-GPOS-00135 | ||||
| STIG | Date | |||
| VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide | 2024-12-16 | |||
Details
Check Text (C-256491r958424_chk)
At the command line, run the following command:
# grep "^space_left_action" /etc/audit/auditd.conf
Expected result:
space_left_action = SYSLOG
If the output does not match the expected result, this is a finding.
Fix Text (F-60109r887146_fix)
Navigate to and open:
/etc/audit/auditd.conf
Ensure the "space_left_action" line is uncommented and set to the following:
space_left_action = SYSLOG
At the command line, run the following commands:
# killproc auditd -TERM
# systemctl start auditd