---
id: V-38468
status: implemented
tag: auditd
---

The default configuration for ``disk_full_action`` is ``SUSPEND``, which only
suspends audit logging. Suspending audit logging can lead to security problems
because the system is no longer keeping track of which syscalls were made.

The security role sets the configuration to ``SYSLOG`` so that messages are
sent to syslog when the disk is full. If syslog messages are being sent to
remote servers, these log messages should alert an administrator about the disk
being full. There are additional options available, like ``EXEC``, ``SINGLE``
or ``HALT``.

To configure a different ``disk_full_action``, set the following
Ansible variable:

.. code-block:: yaml

    security_disk_full_action: SYSLOG

For details on available settings and what they do, run ``man auditd.conf``.
Some options can cause the host to go offline until the issue is fixed.
Deployers are urged to **carefully read the auditd documentation** prior to
changing the ``disk_full_action`` setting from the default.