Profile Applicability:

Level 2

Description:

The max_log_file parameter in the audit daemon’s configuration file controls the maximum size of the audit log file before it is rotated. Ensuring this value is set helps prevent the audit logs from consuming excessive disk space and ensures older logs are managed properly.

Rationale:

Setting a reasonable maximum audit log file size ensures that the logs are managed effectively. This prevents the system from running out of disk space due to uncontrolled audit log growth, which could otherwise disrupt normal operations or prevent critical logs from being recorded.

Impact:

Pros:
Ensures proper disk usage by managing log file size
Supports effective log rotation and retention
Improves stability by preventing full disk issues

Cons:
Improper sizing may rotate logs too quickly or allow excessive growth

Default Value:

On many systems, the default value is 6 MB, which may be insufficient for high-volume environments.

Pre-requisites:

  • auditd must be installed

  • Root or sudo access is required

Test Plan:

Using Linux Command Line:

  1. Check the current max log file size setting:

    grep max_log_file /etc/audit/auditd.conf

Implementation Plan:

Using Linux Command Line:

  1. Reopen the configuration file:

    vi /etc/audit/auditd.conf

  2. Locate or add the following line to configure log size (example for 20 MB):

    max_log_file = 20

  3. Save and exit the file.

  4. Restart the auditd service to apply the changes:

    systemctl restart auditd

Backout Plan:

Using Linux Command Line:

  1. Open the configuration file:

    vi /etc/audit/auditd.conf

  2. Revert max_log_file to its original value or remove the line if it was added.

  3. Restart the auditd service:

    systemctl restart auditd

References:

CIS Amazon Linux 2 Benchmark v3.0.0
Auditd Configuration Documentation
NIST SP 800-53 Revision 5 - AU-11