Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide

The Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide (V2 R3) has 229 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

229STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R3

CurrentPublished Fri Apr 23 2021

The remote audit system must take appropriate action when audit storage is full.

Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide

Assessment Title

Rule Text

The remote audit system must take appropriate action when audit storage is full.

Description

Discussion Text

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-215040

Rule

SV-215040r610931_rule

Severity

medium

Rule Version

UBTU-16-020070

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the action that the remote audit system takes when the storage volume becomes full.

Check the action that the remote audit system takes when the storage volume becomes full with the following command:

# sudo grep disk_full /etc/audisp/audisp-remote.conf

disk_full_action = single

If the value of the "disk_full_action" option is not "syslog", "single", or "halt", or the line is commented out, this is a finding.

Implementation Procedure

Fix Text

Configure the remote audit system to take an appropriate action when the audit storage is full.

Add, edit or uncomment the "disk_full_action" option in "/etc/audisp/audisp-remote.conf". Set it to "syslog", "single" or "halt" like the below example:

disk_full_action = single

STIG check 102 of 229 in the Canonical Ubuntu 16.04 LTS STIG checklist

← Previous · V-215039The audit system must take appropriate action when the audit storage volume is full.Next · V-215041 →Off-loading audit records to another system must be authenticated.