Configure auditd space_left on Low Disk Space
Sets space_left_percentage in /etc/audit/auditd.conf to at least 25, so the low-space warning fires while a quarter of the partition is still free.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
space_left_percentage sets the threshold at which space_left_action is triggered. A threshold that is too low (a tiny percentage) leaves administrators almost no margin to react before the disk is full and auditing stops. Setting it to 25% gives ample lead time to reclaim space, ship logs off-box or investigate before audit records are lost.
What Pavois checks
Pavois reads the effective space_left_percentage value from /etc/audit/auditd.conf and requires it to be 25 or greater. This percentage governs when the running daemon raises the low-space alarm, so the configured value is the meaningful indicator.
describe command('v=$(grep -iE \'^[[:space:]]*space_left[[:space:]]*=[[:space:]]*[0-9]+%\' /etc/audit/auditd.conf 2>/dev/null | grep -oE \'[0-9]+\' | tail -1); { [ -n "$v" ] && [ "$v" -ge 25 ] && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -i '^[[:space:]]*space_left_percentage' /etc/audit/auditd.conf. Expected output: a line such as space_left_percentage = 25 with a value of 25 or more.
Inspect & investigate
When the threshold is crossed, auditd records the resulting space_left_action via journalctl -u auditd; the audit trail itself is in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: set space_left_percentage = 25 (or higher) in /etc/audit/auditd.conf and reload auditd (service auditd reload). Note space_left can be given as an absolute size or a percentage; this rule expects the percentage form.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| file | /etc/audit/auditd.conf |
|---|---|
| key | space_left |
| resource | conf_line |
| service | auditd |
| value | 25% |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A higher percentage simply makes the warning fire earlier, which is harmless and only useful. The setting does nothing unless space_left_action is configured to actually notify or act. Precaution: none for availability, just ensure space_left_action is meaningful (e.g. email/exec) so the earlier warning reaches someone. Reload auditd to apply the change without interrupting coverage.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| PCI DSS | 10.5.1 | supporting | 4.0.1 | medium |
| NIST | AU-5(1), AU-5(2), AU-5(4), AU-5(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-653040, UBTU-24-900960 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.