Configure auditd space_left Action on Low Disk Space
Sets space_left_action in /etc/audit/auditd.conf to a notifying/protective action (email, exec, single or halt) when free audit-log space gets low.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
space_left_action triggers when free disk space crosses the space_left threshold, an early warning before the partition is full. Notifying administrators (email/exec) at this point lets them reclaim space or investigate before auditing stops or the more drastic disk_full_action fires. Leaving it at the default (ignore/suspend) means the first sign of trouble is lost or stalled audit records.
What Pavois checks
Pavois reads the effective space_left_action directive from /etc/audit/auditd.conf and accepts email, exec, single or halt. This value drives what the running daemon does at the low-space threshold, so the configured directive is the reliable indicator.
describe command('grep -qiE \'^[[:space:]]*space_left_action[[:space:]]*=[[:space:]]*(email)\b\' /etc/audit/auditd.conf 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i '^[[:space:]]*space_left_action' /etc/audit/auditd.conf (or auditctl -s). Expected output: space_left_action = email (or exec/single/halt).
Inspect & investigate
When the threshold is crossed, auditd logs the action and any e-mail/exec result via journalctl -u auditd; the audit trail itself is in /var/log/audit/audit.log.
Remediation
Pavois's harden plan writes space_left_action = email into /etc/audit/auditd.conf (a conf_line resource) and notifies the auditd service to reload. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | space_left_action |
| resource | conf_line |
| service | auditd |
| value |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
email is benign but silent if mail is not configured: without a working MTA and a valid action_mail_acct, the warning goes nowhere. single/halt are protective but disruptive (the host drops to single-user mode or stops). Precaution: prefer email (or exec to a monitoring hook) and verify mail delivery, or wire exec to your alerting system. Reserve single/halt for hosts where missing audit data is unacceptable, and ensure console access for recovery.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 10.5.1, 6.2.2.4, 6.3.2.4 | direct | per OS, see the benchmark table | high |
| NIST | 3.3.1, AU-5(1), AU-5(2), AU-5(4), AU-5(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 10.5.1 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-653040, UBTU-24-900960 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.