{"description": "'The setting for disk_full_action in /etc/audit/auditd.conf, if multiple\nvalues are allowed write them separated by pipes as in \"syslog|single|halt\",\nfor remediations the first value will be taken'", "type": "string", "operator": "equals", "interactive": false, "options": {"default": "single", "exec": "exec", "halt": "halt", "single": "single", "suspend": "suspend", "syslog": "syslog", "ignore": "ignore", "rotate": "rotate", "ol8": "syslog|single|halt", "rhel8": "syslog|single|halt", "cis_rhel8": "syslog|single|halt", "cis_rhel9": "halt|single", "cis_rhel10": "halt|single", "cis_ubuntu2204": "halt|single", "cis_ubuntu2404": "halt|single", "cis_debian12": "halt|single"}, "warnings": [], "title": "Action for auditd to take when disk is full", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var"}