Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
Description
Discussion Text
If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.
While "%" is fully compliant for auditd.conf, you must account for how auditd processes it. The percentage-to-megabyte conversion occurs only when the audit daemon starts. If you dynamically resize the underlying logical volume/partition where /var/log/audit resides while the system is running, the daemon will not automatically know. You must reload it to trigger a recalculation.
While "%" is fully compliant for auditd.conf, you must account for how auditd processes it. The percentage-to-megabyte conversion occurs only when the audit daemon starts. If you dynamically resize the underlying logical volume/partition where /var/log/audit resides while the system is running, the daemon will not automatically know. You must reload it to trigger a recalculation.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.