V-215253

Discussion

In order to ensure operating systems have a sufficient storage capacity in which to write the audit logs, operating systems need to be able to allocate audit record storage capacity. The task of allocating audit record storage capacity is usually performed during initial installation of AIX.

Check Content

Check the file system size where the log file resides is greater than the organizationally defined size of audit logs for one week (1GB). 

Find out where the audit log resides: 
# grep trail /etc/security/audit/config 
        trail = /audit/trail

Find out the available space in the file system hosting the audit logs. 

# df /audit/trail
Filesystem    512-blocks      Free %Used    Iused %Iused Mounted on
/dev/hd4         1966080   1792872    9%     3913     2% /

If the "512-blocks" multiplied by "Free" is less than the required size for the audit logs, this is a finding.