STIG ID: SLES-15-030800 | SRG: SRG-OS-000479-GPOS-00224 | Severity: medium | CCI: | Vulnerability Id: V-234979
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Off-loading is a common process in information systems with limited audit storage capacity.
Configure the SUSE operating system to take the appropriate action if the audit storage is full.
Add, edit, or uncomment the "disk_full_action" option in "/etc/audisp/audisp-remote.conf". Set it to "syslog", "single" or "halt" as in the example below:
disk_full_action = syslog
Verify the audit system off-loads audit records if the SUSE operating system storage volume becomes full.
Check that the records are properly off-loaded to a remote server with the following command:
> sudo grep -i "disk_full_action" /etc/audisp/audisp-remote.conf
disk_full_action = syslog
If "disk_full_action" is not set to "syslog", "single", or "halt" or the line is commented out, this is a finding.