Configure auditd max_log_file_action Upon Reaching Maximum Log Size
Sets max_log_file_action = keep_logs in /etc/audit/auditd.conf so audit logs are never overwritten when a log file reaches its size limit.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
When an audit log file reaches max_log_file, auditd must decide what to do. keep_logs rotates without ever deleting old logs, so no audit history is silently destroyed, critical for systems that must retain a complete trail or ship logs off-box before reclaiming space. The weaker rotate reclaims space automatically but discards the oldest data; keep_logs favours retention, leaving space management to an external process and avoiding accidental loss of evidence.
What Pavois checks
Pavois reads the effective max_log_file_action directive from /etc/audit/auditd.conf and requires keep_logs. This value drives the running daemon's rotation behaviour, so the configured directive is the reliable indicator of whether logs can be lost.
describe command('grep -qiE "^[[:space:]]*max_log_file_action[[:space:]]*=[[:space:]]*rotate" /etc/audit/auditd.conf && grep -qiE "^[[:space:]]*num_logs[[:space:]]*=[[:space:]]*[1-9]" /etc/audit/auditd.conf && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i '^[[:space:]]*max_log_file_action' /etc/audit/auditd.conf. Expected output: max_log_file_action = keep_logs.
Inspect & investigate
Rotated files appear alongside /var/log/audit/audit.log (e.g. audit.log.1); rotation actions and any space-related warnings show in journalctl -u auditd.
Remediation
Pavois's harden plan writes max_log_file_action = keep_logs into /etc/audit/auditd.conf (a conf_line resource) and notifies the auditd service to reload. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | sed -ri 's/^[[:space:]]*max_log_file_action.*/max_log_file_action = ROTATE/' /etc/audit/auditd.conf; grep -qiE '^[[:space:]]*num_logs' /etc/audit/auditd.conf && sed -ri 's/^[[:space:]]*num_logs.*/num_logs = 20/' /etc/audit/auditd.conf || echo 'num_logs = 20' >> /etc/audit/auditd.conf; systemctl kill -s SIGHUP auditd 2>/dev/null; true |
|---|---|
| name | auditd-rotate |
| not_if | grep -qiE '^[[:space:]]*max_log_file_action[[:space:]]*=[[:space:]]*rotate' /etc/audit/auditd.conf && grep -qiE '^[[:space:]]*num_logs[[:space:]]*=[[:space:]]*[1-9]' /etc/audit/auditd.conf |
| resource | exec |
| service | auditd |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
keep_logs never reclaims space on its own, so audit logs grow until the partition fills if nothing exports or prunes them, at which point disk_full_action/space_left_action take over (potentially halting the host). Precaution: put audit logs on a dedicated, monitored partition and set up log shipping or an external rotation/archival job before enabling keep_logs. Pair this rule with space_left_action/admin_space_left_action so you are alerted well before the disk is exhausted.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.2.2, 6.3.2.2 | direct | per OS, see the benchmark table | high |
| NIST | AU-5(1), AU-5(2), AU-5(4), AU-5(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 10.5.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.