V-286215

Discussion

To ensure sufficient storage capacity for the audit logs, MariaDB must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates that audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism. The task of allocating audit record storage capacity is usually performed during initial installation of MariaDB and is closely associated with the DBA and system administrator (SA) roles. The DBA or SA will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both. In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on MariaDB s ability to reuse the space formerly occupied by off-loaded records.

Check Content

Investigate whether there have been any incidents where MariaDB ran out of audit file log disk space since the last time the space was allocated or other corrective measures were taken.

If there have been incidents where MariaDB ran out of audit log file disk space, this is a finding.

MariaDB can be configured to use syslog or any OS system file to store audit records to designated disk directories.

Check the log file location. As the DBA (shown here as root), run:

SHOW GLOBAL VARIABLES like  'server_audit%' ;

If using system logs (syslog), run: 

     From the query above verify the value of:
       server_audit_output_type=SYSLOG

If written to "SYSLOG", follow the procedure for storage in the corresponding OS STIG.

If using an OS file, run:

     From the query above verify the value of:
       server_audit_output_type=FILE

If written to "FILE", check the remaining storage on the disk. If it does not meet organizationally defined audit record storage requirements, this is a finding.