AU-04 Audit Log Storage Capacity
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Audit Log Storage Capacity
Control
Allocate audit log storage capacity to accommodate [Assignment: audit log retention requirements].
Discussion
Organizations consider the types of audit logging to be performed and the audit log processing requirements when allocating audit log storage capacity. Allocating sufficient audit log storage capacity reduces the likelihood of such capacity being exceeded and resulting in the potential loss or reduction of audit logging capability.
Parameters
au-04_odp: audit log retention requirements
Related controls
au-11, au-12, au-14, au-2, au-5, au-6, au-7, au-9, si-4
Assessment objective
AU-04 audit log storage capacity is allocated to accommodate [Assignment: audit log retention requirements].
STIG rules that implement this control 22
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001029 CAT III The macOS system must configure audit retention to seven days.
- APPL-15-004050 CAT III The macOS system must configure install.log retention to 365.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001029 CAT III The macOS system must configure audit retention to seven days.
- APPL-26-004050 CAT III The macOS system must configure install.log retention to 365.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-653035 CAT III Ubuntu 22.04 LTS must allocate audit record storage capacity to store at least one weeks' worth of audit records, when audit records are not immediately sent to a central audit record storage facility.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-900920 CAT III Ubuntu 24.04 LTS must allocate audit record storage capacity to store at least one week's worth of audit records, when audit records are not immediately sent to a central audit record storage facility.
Cisco IOS XE Router NDM Y26M04
- CISC-ND-000980 CAT II The Cisco router must be configured to allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.
Microsoft Windows 11 V2R11
- WN11-AU-000500 CAT II The Application event log size must be configured to 32768 KB or greater.
- WN11-AU-000505 CAT II The security event log size must be configured to a value that holds at least one week's worth of audit records.
- WN11-AU-000510 CAT II The System event log size must be configured to 32768 KB or greater.
Microsoft Windows Server 2022 V2R11
- WN22-CC-000270 CAT II Windows Server 2022 Application event log size must be configured to 32768 KB or greater.
- WN22-CC-000280 CAT II The Windows Server 2022 security event log size must be configured to a value that holds at least one week's worth of audit records.
- WN22-CC-000290 CAT II Windows Server 2022 System event log size must be configured to 32768 KB or greater.
Microsoft Windows Server 2025 V1R4
- WN25-CC-000270 CAT II Windows Server 2025 Application event log size must be configured to 32768 KB or greater.
- WN25-CC-000280 CAT II Windows Server 2025 Security event log size must be configured to a value that holds at least one week of audit records.
- WN25-CC-000290 CAT II Windows Server 2025 System event log size must be configured to 32768 KB or greater.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-000520 CAT III RHEL 10 must use a separate file system for the system audit data path.
- RHEL-10-500030 CAT II RHEL 10 must allocate an "audit_backlog_limit" of sufficient size to capture processes that start prior to the audit daemon.
- RHEL-10-500100 CAT III RHEL 10 must allocate audit record storage capacity to store at least one week's worth of audit records.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-231030 CAT III RHEL 9 must use a separate file system for the system audit data path.
- RHEL-09-653030 CAT II RHEL 9 must allocate audit record storage capacity to store at least one week's worth of audit records.
- RHEL-09-653120 CAT III RHEL 9 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon.