Configure auditd Disk Full Action when Disk Space Is Full
Sets disk_full_action in /etc/audit/auditd.conf to single (or halt) so the system reacts decisively when the audit partition is full.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When the disk holding audit logs is completely full, auditd can no longer record events. If no defensive action is taken, the system keeps running blind, privilege escalations, file tampering and intrusions go unrecorded, destroying accountability and forensic evidence. Switching to single-user mode (single) or halting (halt) forces an administrator to intervene before any further unaudited activity can occur.
What Pavois checks
Pavois reads the effective disk_full_action directive from /etc/audit/auditd.conf and requires it to be halt or single. The value governs the running daemon's behaviour, so confirming the configured directive is the reliable indicator of what auditd will do on a full disk.
describe command('grep -qiE \'^[[:space:]]*disk_full_action[[:space:]]*=[[:space:]]*(syslog|email|exec|single|halt)\b\' /etc/audit/auditd.conf 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i '^[[:space:]]*disk_full_action' /etc/audit/auditd.conf (or auditctl -s for the daemon view). Expected output: disk_full_action = single (or halt).
Inspect & investigate
Watch /var/log/audit/audit.log for events stopping when the disk fills, and the daemon's reaction in journalctl -u auditd. The kernel audit subsystem also emits audit: ... disk_full style messages to the system journal.
Remediation
Pavois's harden plan writes disk_full_action = single into /etc/audit/auditd.conf (a conf_line resource) and notifies the auditd service to reload the new policy. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | disk_full_action |
| resource | conf_line |
| service | auditd |
| value | syslog |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
With single or halt, a full audit disk will take the host offline (single-user mode) or stop it, intentional, but disruptive on production. Precaution: ensure audit logs sit on a dedicated partition with adequate size and a working rotation policy (max_log_file, num_logs, space_left_action) so the disk-full condition is rare. On remote/headless hosts, halt requires physical or console access to recover; prefer single and pair it with monitoring/alerting so you act before the disk fills.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.2.3, 6.3.2.3 | direct | per OS, see the benchmark table | high |
| NIST | AU-5(1), AU-5(2), AU-5(4), AU-5(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-653030 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.