Configure auditd Disk Error Action on Disk Error
Sets disk_error_action in /etc/audit/auditd.conf to a defined reaction (syslog, single or halt) when auditd hits a disk write error.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Taking appropriate action in case of disk errors will minimize the possibility of losing audit records.
What Pavois checks
Pavois greps /etc/audit/auditd.conf for disk_error_action = syslog|single|halt and expects ok. Reading the daemon's effective config shows the reaction auditd will actually perform on a disk error, independent of compile-time defaults.
describe command('grep -qiE \'^[[:space:]]*disk_error_action[[:space:]]*=[[:space:]]*(syslog|single|halt)\b\' /etc/audit/auditd.conf 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i disk_error_action /etc/audit/auditd.conf. Expected: disk_error_action = syslog (or single/halt). Reload auditd to apply.
Inspect & investigate
- With
syslog, errors land in the system journal //var/log/syslog(journalctl -u auditd). /var/log/audit/audit.loganddmesgcorroborate the underlying disk fault.
Remediation
Pavois's harden plan uses the conf_line resource to set disk_error_action = syslog in /etc/audit/auditd.conf, then notifies the auditd service to reload. syslog is chosen as the least disruptive defined reaction. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | disk_error_action |
| resource | conf_line |
| service | auditd |
| value | syslog |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without a defined action, a disk error can silently drop audit records, creating gaps in the trail. syslog is low-risk (it only logs); choosing single or halt instead stops the host on error, appropriate for high-assurance systems but capable of interrupting production, so reserve those for hosts where losing audit data is unacceptable and ensure console access first.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.2.3, 6.3.2.3 | direct | per OS, see the benchmark table | high |
| NIST | AU-5(1), AU-5(2), AU-5(4), AU-5(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.