# Ensure audit logs are not automatically deleted (Automated)

- Source: https://support.icompaas.com/support/solutions/articles/62000235490-ensure-audit-logs-are-not-automatically-deleted-automated-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Linux 2 Benchmark v3.0.0](https://support.icompaas.com/support/solutions/62000112696) › [CIS Amazon Linux 2 Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169265)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

Level 2

### **Description:**

The `max_log_file_action` parameter in the audit daemon’s configuration determines what action to take when the log file size defined by `max_log_file` is reached. Setting this parameter to `keep_logs` ensures that audit logs are never automatically deleted and are preserved for review and forensic analysis.

### **Rationale:**

Preserving audit logs is critical for investigating suspicious activity, understanding historical events, and meeting regulatory compliance. Automatically deleting logs can result in the loss of valuable information and reduce visibility into system activity.

### **Impact:**

**Pros:**  
Preserves important audit records for investigations and compliance  
Avoids accidental or automatic data loss  
Supports long-term retention policies

**Cons:**  
Requires adequate disk space to store logs  
May require manual cleanup or archiving strategy

### **Default Value:**

On many systems, `max_log_file_action` may be set to `ROTATE`, which may overwrite older logs.

### **Pre-requisites:**

-   `auditd` must be installed
    
-   Root or `sudo` access is required
    

### **Test Plan:**

**Using Linux Command Line:**

1.  Check the current value for log file action:
    
    grep max\_log\_file\_action /etc/audit/auditd.conf
    

### **Implementation Plan:**

**Using Linux Command Line:**

1.  Open the configuration file:
    
    vi /etc/audit/auditd.conf
    
2.  Locate or add the following line to ensure logs are not deleted:
    
    max\_log\_file\_action = keep\_logs
    
3.  Save and exit the file.
    
4.  Restart the auditd service to apply the changes:
    
    systemctl restart auditd
    

### **Backout Plan:**

**Using Linux Command Line:**

1.  Reopen the configuration file:
    
    vi /etc/audit/auditd.conf
    
2.  Revert the `max_log_file_action` value to its previous setting, such as `rotate` or `suspend`.
    
3.  Restart the auditd service:
    
    systemctl restart auditd
    

### **References:**

CIS Amazon Linux 2 Benchmark v3.0.0  
Auditd Configuration Documentation  
NIST SP 800-53 Revision 5 - AU-4

###

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.