|Platform: macosx10.10||Date: (C)2015-06-23 (M)2018-03-17|
Audit has insufficient storage
The audit service must be configured to require a minimum percentage of free disk space in order to run. This ensures that audit will notify the administrator that action is required to free up more disk space for audit logs.
When minfree is set to 25%, security personnel are notified immediately when the storage volume is 75% full and are able to plan for audit record storage capacity expansion.
% of free volume
The check displays the '% free' to leave available for the system. The audit system will not write logs if the volume has less than this percentage of free disk space. To view the current setting, run the following command:
sudo grep ^minfree /etc/security/audit_control
If this returns no results, or an incorrect setting for the organization, this is a finding.
|SCAP Repo OVAL Definition||oval:org.secpod.oval:def:25102|