1.0 KiB
---id: V-38468 status: implemented tag: auditd ---
The default configuration for disk_full_action is
SUSPEND, which only suspends audit logging. Suspending
audit logging can lead to security problems because the system is no
longer keeping track of which syscalls were made.
The security role sets the configuration to SYSLOG so
that messages are sent to syslog when the disk is full. If syslog
messages are being sent to remote servers, these log messages should
alert an administrator about the disk being full. There are additional
options available, like EXEC, SINGLE or
HALT.
To configure a different disk_full_action, set the
following Ansible variable:
security_disk_full_action: SYSLOGFor details on available settings and what they do, run
man auditd.conf. Some options can cause the host to go
offline until the issue is fixed. Deployers are urged to
carefully read the auditd documentation prior to
changing the disk_full_action setting from the default.