documentation_complete: true

title: 'Reduce Logging To Decrease Storage Capacity Limitations'

description: |-
    The server must configure auditing to reduce the
    likelihood of storage capacity being exceeded.

rationale: |-
    The server auditing capability is critical for accurate
    forensic analysis. Alerting administrators when audit log
    size thresholds are exceeded helps ensure the administrators
    can respond to heavy activity in a timely manner. Failure to
    alert increases the probability that an adversary's actions
    will go undetected. The server or the configured Network
    Attached Storage Device (SAN) must alert administrators
    when audit log usage reaches a defined percentage of overall
    capacity.

severity: low

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: ""

ocil_clause: 'logging capacity has not been reduced'
