← Back to Solaris 11 SPARC Security Technical Implementation Guide

V-219968

CAT I (High)

The operating system must configure auditing to reduce the likelihood of storage capacity being exceeded.

Rule ID

SV-219968r1207680_rule

STIG

Solaris 11 SPARC Security Technical Implementation Guide

Version

V3R6

CCIs

CCI-001849

Discussion

Overflowing the audit storage area can result in a denial of service or system outage.

Check Content

The Audit Configuration profile is required.

This check applies to the global zone only. Determine the zone that is currently being secured.

# zonename

If the command output is "global", this check applies.

Check the status of the audit system. It must be auditing.

# pfexec auditconfig -getplugin 

p_fsize=4M (example output)

If the output of this command does not contain a specific file size, this is a finding.

Fix Text

The Audit Control profile is required.

This action applies to the global zone only. Determine the zone that is currently being secured.

# zonename

If the command output is "global", this action applies.

Set the size of a binary audit file to a specific size. The size is specified in megabytes.

The example below shows “4M” (4 megabytes) as a suggested value.

# pfexec auditconfig -setplugin audit_binfile p_fsize=4M

Restart the audit system.

# pfexec audit -s