Configure auditd Max Log File Size
Sets max_log_file in /etc/audit/auditd.conf to at least 6 (MB) so each audit log file is large enough to retain a useful window of events.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Total audit retention is a product of the per-file size (max_log_file) and the number of files kept (num_logs). If max_log_file is too small, logs rotate too quickly and the retained history covers only a short window, insufficient to investigate an incident discovered days later. A floor of 6 MB ensures each file holds enough events to make the retained set meaningful.
What Pavois checks
Pavois reads the effective max_log_file value (in MB) from /etc/audit/auditd.conf and requires it to be 6 or greater. This number controls the running daemon's rotation threshold, so the configured value is the meaningful indicator.
describe command('v=$(grep -iE \'^[[:space:]]*max_log_file[[:space:]]*=\' /etc/audit/auditd.conf 2>/dev/null | grep -oE \'[0-9]+\' | tail -1); { [ -n "$v" ] && [ "$v" -ge 6 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i '^[[:space:]]*max_log_file' /etc/audit/auditd.conf. Expected output: a line such as max_log_file = 8 with a value of 6 or more.
Inspect & investigate
Observe the size and rotation of files under /var/log/audit/ (ls -lh /var/log/audit/); rotation events appear in journalctl -u auditd.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: set max_log_file = 8 (or any value ≥ 6) in /etc/audit/auditd.conf and reload auditd (service auditd reload).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | max_log_file |
| resource | conf_line |
| service | auditd |
| value | 8 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A larger max_log_file combined with num_logs raises the maximum disk footprint of the audit logs (worst case ≈ max_log_file × num_logs). Precaution: size the audit partition for that worst case and confirm space_left_action/disk_full_action are configured so a full disk is handled gracefully. The change is non-disruptive to running services; reload auditd rather than stopping it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.2.1, 6.3.2.1 | direct | per OS, see the benchmark table | high |
| NIST | AU-11, CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 10.5.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.