Configure auditd mail_acct Action on Low Disk Space
Ensures action_mail_acct = root in /etc/audit/auditd.conf so auditd emails an administrator when audit disk space runs low.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action.
What Pavois checks
Pavois greps /etc/audit/auditd.conf for action_mail_acct = root and expects ok. auditd.conf is the daemon's single configuration file (no drop-in fragmentation), so reading it reflects exactly what auditd will use after its next reload, the effective notification target.
describe command('grep -qiE \'^[[:space:]]*action_mail_acct[[:space:]]*=[[:space:]]*(root)\b\' /etc/audit/auditd.conf 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i action_mail_acct /etc/audit/auditd.conf. Expected: action_mail_acct = root. After reloading auditd, the setting is live.
Inspect & investigate
/var/log/audit/audit.logand the auditd journal (journalctl -u auditd) record disk-space events and the daemon's reactions.- A local mail transport must be present for the alert to reach
root(check the mail spool /mailq).
Remediation
No automated remediation is wired for this rule. Apply manually, set action_mail_acct = root in /etc/audit/auditd.conf, then reload with augenrules --load or systemctl reload auditd. Ensure a working MTA so root's mail is delivered to admins.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | action_mail_acct |
| resource | conf_line |
| service | auditd |
| value | root |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without a notification account, admins learn of audit-storage exhaustion only after records are already being lost. Setting it is harmless; the real prerequisite is a functioning mail path (alias root → a monitored mailbox), otherwise the alert is generated but never read.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.2.4, 6.3.2.4 | direct | per OS, see the benchmark table | high |
| NIST | 3.3.1, AU-5(2), AU-5(a), CM-6(a), IA-5(1) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-653025, UBTU-24-900980 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.