← Back to VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide

V-256529

CAT II (Medium)

The Photon operating system must configure auditd to log space limit problems to syslog.

Rule ID

SV-256529r971542_rule

STIG

VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide

Version

V1R4

CCIs

CCI-001855

Discussion

If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.

Check Content

At the command line, run the following command:

# grep "^space_left " /etc/audit/auditd.conf

Expected result:

space_left = 75

If the output does not match the expected result, this is a finding.

Fix Text

Navigate to and open:

/etc/audit/auditd.conf

Ensure the "space_left" line is uncommented and set to the following:

space_left = 75

At the command line, run the following commands:

# killproc auditd -TERM
# systemctl start auditd