AU-05(01) Storage Capacity Warning
All changes in this version
Title
Storage Capacity Warning
Control
Provide a warning to [Assignment: personnel, roles, and/or locations] within [Assignment: time period] when allocated audit log storage volume reaches [Assignment: percentage] of repository maximum audit log storage capacity.
Discussion
Organizations may have multiple audit log storage repositories distributed across multiple system components with each repository having different storage volume capacities.
Parameters
au-05.01_odp.01: personnel, roles, and/or locations
au-05.01_odp.02: time period
au-05.01_odp.03: percentage
Assessment objective
AU-05(01) a warning is provided to [Assignment: personnel, roles, and/or locations] within [Assignment: time period] when allocated audit log storage volume reaches [Assignment: percentage] of repository maximum audit log storage capacity.
STIG rules that implement this control 15
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001030 CAT II The macOS system must configure audit capacity warning.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001030 CAT II The macOS system must configure audit capacity warning.
Application Security and Development V6R5
- APSC-DV-001090 CAT II The application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-653040 CAT III Ubuntu 22.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) when the audit record storage volume reaches 25 percent remaining of the allocated capacity.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-900960 CAT III Ubuntu 24.04 LTS must immediately notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-500040 CAT II RHEL 10 must take action when allocated audit record storage volume reaches 75 percent of the audit record storage capacity.
- RHEL-10-500105 CAT II RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
- RHEL-10-500110 CAT II RHEL 10 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
- RHEL-10-500205 CAT II RHEL 10 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume 75 percent utilization.
- RHEL-10-500210 CAT II RHEL 10 must notify the system administrator (SA) and/or information system security officer (ISSO) (at a minimum) of an audit processing failure.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-653035 CAT II RHEL 9 must take action when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
- RHEL-09-653040 CAT II RHEL 9 must notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent utilization.
- RHEL-09-653045 CAT II RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the audit record storage capacity.
- RHEL-09-653050 CAT II RHEL 9 must take action when allocated audit record storage volume reaches 95 percent of the repository maximum audit record storage capacity.
- RHEL-09-653070 CAT II RHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.