{"description": "The setting for space_left_action in /etc/audit/auditd.conf", "type": "string", "operator": "equals", "interactive": false, "options": {"default": "email", "email": "email", "exec": "exec", "halt": "halt", "single": "single", "suspend": "suspend", "syslog": "syslog", "rotate": "rotate", "ignore": "ignore", "cis_rhel8": "email|exec|single|halt", "cis_rhel9": "email|exec|single|halt", "cis_rhel10": "email|exec|single|halt"}, "warnings": [], "title": "Action for auditd to take when disk space just starts to run low", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var"}