Decide and configure what happens when the audit disk fills up

Description

/etc/audit/auditd.conf sets what auditd does as the partition holding /var/log/audit fills up. Debian ships space_left_action = SYSLOG, admin_space_left_action = SUSPEND, disk_full_action = SUSPEND and disk_error_action = SUSPEND: audit stops and the system carries on, and nobody is warned.

The disk_full_policy parameter records the choice of the organization:

• stop-system (default, accountability first): nothing may happen unrecorded. When the partition is almost full (admin_space_left) or full, the system goes to single user mode or halts ({{ admin_space_left_action }} / {{ disk_full_action }}). Remote sessions and services stop until an administrator frees space at the console.
• keep-running (availability first): auditd suspends itself (suspend) and the system keeps serving. Actions done while the partition is full are not recorded.

In both cases space_left_action must warn someone early (email, exec, single or halt; fix: {{ space_left_action }}), and disk_error_action must be syslog, single or halt (fix: {{ disk_error_action }}).

Rationale

Accountability requires that nothing happens without being recorded: on systems that must prove who did what (regulated, high-value), stop-system is the right choice. On systems where an outage is worse than a gap in the audit trail, keep-running is acceptable, provided the early warning reaches someone. What is never acceptable is the Debian default, which stops auditing without warning anybody.

Impact

With stop-system, a full audit partition stops remote sessions and services: SSH becomes unreachable, recovery needs the console. This is why the fix is disabled by default in generated artifacts (lockout_risk); enable it once the policy is chosen. With keep-running, the system stays up but the audit trail has a gap. In both cases, monitor the free space and archive audit logs in time. email needs a working local mail transport, otherwise only a syslog message is written.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

Run grep -Ei '^\s*(space_left|admin_space_left|disk_full|disk_error)_action' /etc/audit/auditd.conf. space_left_action must be email, exec, single or halt and disk_error_action syslog, single or halt. With disk_full_policy = stop-system, admin_space_left_action and disk_full_action must be single or halt; with keep-running, suspend is also accepted.

Automated: every check must pass. Scanners report each check by its id.

actions

Disk space actions in auditd.conf.

script: |
  f=/etc/audit/auditd.conf
  [ -r "$f" ] || { echo "$f not found: auditd is not installed"; exit 1; }
  get() { sed -n "s/^[[:space:]]*$1[[:space:]]*=[[:space:]]*\([^[:space:]]*\).*/\1/p" "$f" | tail -n 1 | tr 'A-Z' 'a-z'; }
  rc=0
  stop=single,halt
  [ "$CB_DISK_FULL_POLICY" = keep-running ] && stop=suspend,single,halt
  echo "disk_full_policy=$CB_DISK_FULL_POLICY"
  for kv in space_left_action:email,exec,single,halt admin_space_left_action:$stop \
    disk_full_action:$stop disk_error_action:syslog,single,halt; do
    k=${kv%%:*} v=$(get "${kv%%:*}")
    echo "$k=${v:-unset}"
    case ",${kv#*:}," in *",${v:-unset},"*) ;; *) rc=1 ;; esac
  done
  exit "$rc"

Remediation

1. Choose the policy, stop-system or keep-running (see the description), and record it in the tailoring file as disk_full_policy.
2. In /etc/audit/auditd.conf, set space_left_action = {{ space_left_action }} and disk_error_action = {{ disk_error_action }}.
3. With stop-system, set admin_space_left_action = {{ admin_space_left_action }} and disk_full_action = {{ disk_full_action }}; with keep-running, set both to suspend.
4. Run systemctl restart auditd.

Rollback

Set the four actions back to SYSLOG / SUSPEND in /etc/audit/auditd.conf and restart auditd.

auditd-conf

f=/etc/audit/auditd.conf
[ -f "$f" ] || { echo "$f not found: auditd is not installed" >&2; exit 1; }
cb_backup "$f"
set_kv() {
  sed -i "/^[[:space:]]*$1[[:space:]]*=/d" "$f"
  printf '%s = %s\n' "$1" "$2" >>"$f"
}
set_kv space_left_action "$CB_SPACE_LEFT_ACTION"
if [ "$CB_DISK_FULL_POLICY" = keep-running ]; then
  set_kv admin_space_left_action suspend
  set_kv disk_full_action suspend
else
  set_kv admin_space_left_action "$CB_ADMIN_SPACE_LEFT_ACTION"
  set_kv disk_full_action "$CB_DISK_FULL_ACTION"
fi
set_kv disk_error_action "$CB_DISK_ERROR_ACTION"

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• auditd.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-AUDIT-011 Install and run the audit daemon
• related CB-DEB-AUDIT-013 Keep audit logs instead of rotating them away

People and lifecycle