Configure auditd admin_space_left Action on Low Disk Space
Sets admin_space_left_action in /etc/audit/auditd.conf to a hard reaction (single or halt) when audit storage hits the admin threshold.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Administrators should be made aware of an inability to record audit records. If a separate partition or logical volume of adequate size is used, running low on space for audit records should never occur.
What Pavois checks
Pavois greps /etc/audit/auditd.conf for admin_space_left_action = single|halt and expects ok. Reading the daemon's own config file reflects the effective policy auditd enforces, the action it will actually take when the critical low-space threshold is reached.
describe command('grep -qiE \'^[[:space:]]*admin_space_left_action[[:space:]]*=[[:space:]]*(syslog|email|exec|single|halt)\b\' /etc/audit/auditd.conf 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i admin_space_left_action /etc/audit/auditd.conf. Expected: admin_space_left_action = halt (or single). Reload auditd to apply.
Inspect & investigate
journalctl -u auditdand/var/log/audit/audit.logrecord when the admin threshold is crossed and the action taken.df -h /var/log/auditshows remaining space on the audit volume.
Remediation
Pavois's harden plan uses the conf_line resource to set admin_space_left_action = halt in /etc/audit/auditd.conf, then notifies the auditd service to reload so the new policy takes effect. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | admin_space_left_action |
| resource | conf_line |
| service | auditd |
| value | syslog |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
halt (and to a lesser extent single) is intentionally drastic: when audit space is critically low the host can power off or drop to single-user mode, which stops production workloads. This is the correct fail-closed behaviour for high-assurance systems, but on general-purpose servers consider sizing a dedicated /var/log/audit partition and offloading logs first; test in staging and ensure you have console access before enabling, to avoid being locked out of a halted host.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 10.5.1, 6.2.2.4, 6.3.2.4 | direct | per OS, see the benchmark table | high |
| NIST | 3.3.1, AU-5(1), AU-5(2), AU-5(4), AU-5(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 10.5.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.