Configure auditd admin_space_left on Low Disk Space
Ensures admin_space_left_percentage in /etc/audit/auditd.conf is set to at least 5 %, defining the critical audit-disk threshold by percentage.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
Why this rule matters
Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.
What Pavois checks
Pavois reads the last admin_space_left_percentage value from /etc/audit/auditd.conf and expects a number ≥ 5. Parsing the daemon's effective config (last value wins, as auditd does) reflects the real threshold rather than assuming a documented default.
describe command('v=$(grep -iE \'^[[:space:]]*admin_space_left[[:space:]]*=[[:space:]]*[0-9]+%\' /etc/audit/auditd.conf 2>/dev/null | grep -oE \'[0-9]+\' | tail -1); { [ -n "$v" ] && [ "$v" -ge 5 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i admin_space_left_percentage /etc/audit/auditd.conf. The value must be 5 or higher (e.g. admin_space_left_percentage = 5).
Inspect & investigate
journalctl -u auditdand/var/log/audit/audit.loglog when the admin threshold is reached.df -h /var/log/auditshows current free space against the configured percentage.
Remediation
No automated remediation is wired for this rule. Apply manually, add or update admin_space_left_percentage = 5 (or higher) in /etc/audit/auditd.conf, then reload with systemctl reload auditd. This option exists on RHEL 9's auditd (hence the rule is RHEL 9 only).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | admin_space_left |
| resource | conf_line |
| service | auditd |
| value | 5% |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Pairing a percentage threshold with admin_space_left_action is what triggers timely alerts; a too-low value leaves no reaction margin. The setting is safe to apply, but remember it works in concert with the action directive, set a meaningful action (mail/syslog/single/halt) too, or the threshold fires with no useful consequence.