Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

The Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide (V1 R8) has 439 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

439STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R8

CurrentPublished Wed Sep 30 2026

AlmaLinux OS 9 audit system must make full use of the audit storage space.

Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide

Assessment Title

Rule Text

AlmaLinux OS 9 audit system must make full use of the audit storage space.

Description

Discussion Text

max_log_file (size in megabytes) multiplied by num_logs must make full use of the auditd storage volume (separate to the root partition).

If max_log_file_action is set to ROTATE or KEEP_LOGS then max_log_file must be set to a value that makes the most use of the storage available.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-269528

Rule

SV-269528r1050411_rule

Severity

medium

Rule Version

ALMA-09-054360

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify that AlmaLinux OS 9 is configured to make full use of the auditd storage volume when rotation is enabled, with the following command:

$ grep max_log_file /etc/audit/auditd.conf

max_log_file = 8

If the value of the "max_log_file" option is not sufficiently large to maximize the use of the storage volume, is commented out, or is missing, this is a finding.

Implementation Procedure

Fix Text

Configure AlmaLinux OS 9 to make full use of the auditd storage volume with rotation enabled.
 
Add or update the following line in the "/etc/audit/auditd.conf" file to a value large enough to make efficient use of the auditd storage volume:
 
max_log_file = 100

STIG check 412 of 439 in the Cloud Linux AlmaLinux OS 9 STIG checklist

← Previous · V-269527AlmaLinux OS 9 must take appropriate action when a critical audit processing failure occurs.Next · V-269529 →AlmaLinux OS 9 audit system must take appropriate action when the audit files have reached maximum size.