documentation_complete: true

title: 'Configure auditd admin_space_left Action on Low Disk Space'

description: "The <tt>auditd</tt> service can be configured to take an action\nwhen disk space is running low but prior to running out of space completely. \nEdit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,\nsubstituting <i>ACTION</i> appropriately:\n<pre>admin_space_left_action = <i>ACTION</i></pre>\nSet this value to <tt>single</tt> to cause the system to switch to single-user\nmode for corrective action. Acceptable values also include <tt>suspend</tt> and\n<tt>halt</tt>. For certain systems, the need for availability\noutweighs the need to log all actions, and a different setting should be\ndetermined. Details regarding all possible values for <i>ACTION</i> are described in the\n<tt>auditd.conf</tt> man page."

rationale: |-
    Administrators should be made aware of an inability to record
    audit records. If a separate partition or logical volume of adequate size
    is used, running low on space for audit records should never occur.

severity: medium

identifiers:
    cce: 27239-3

references:
    disa: 140,1343
    nist: AU-1(b),AU-4,AU-5(b),IR-5
    pcidss: Req-10.7
    srg: SRG-OS-999999
    stigid: RHEL-06-000163

ocil_clause: 'the system is not configured to switch to single-user mode for corrective action'

ocil: |-
    Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
    determine if the system is configured to either suspend, switch to single-user mode,
    or halt when disk space has run low:
    <pre>admin_space_left_action single</pre>
