Rule ID
SV-286216r1292205_rule
Version
V1R1
CCIs
Organizations are required to use a central log management system; so, under normal conditions, the audit space allocated to the DBMS on its own server will not cause an issue. However, space will still be required on the MariaDB server for audit records in transit, and, under abnormal conditions, this could fill up. Since a requirement exists to halt processing upon audit failure, a service outage would result. If support personnel are not notified immediately upon storage volume utilization reaching 75 percent, they are unable to plan for storage capacity expansion. The appropriate support staff include, at a minimum, the information system security officer (ISSO) and the database administrator (DBA)/system administrator (SA).
Check the log file location. As the DBA (shown here as root), run:
SHOW GLOBAL VARIABLES LIKE 'server_audit_output_type';
If using system logs (syslog), run:
From the query above verify the value of:
server_audit_output_type=SYSLOG
If written to SYSLOG, follow the procedure for storage in the corresponding OS STIG.
If using an OS file, run:
From the query above verify the value of:
server_audit_output_type=FILE
If appropriate support staff are not notified immediately upon storage volume utilization reaching 75 percent, this is a finding.Configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75 percent.
MariaDB does not monitor storage; however, it is possible to monitor storage with a script.
##### Example Monitoring Script:
#!/bin/bash
DATADIR=/var/lib/psql/mysql
CURRENT=$(df ${DATADIR?} | grep / | awk '{ print $5}' | sed 's/%//g')
THRESHOLD=75
if [ "$CURRENT" -gt "$THRESHOLD" ] ; then
mail -s 'Disk Space Alert' mail@support.com << EOF
The data directory volume is almost full. Used: $CURRENT
%EOF
fi
Schedule this script in cron to run nonstop.