{"description": "'The setting for disk_error_action in /etc/audit/auditd.conf, if multiple\nvalues are allowed write them separated by pipes as in \"syslog|single|halt\",\nfor remediations the first value will be taken'", "type": "string", "operator": "equals", "interactive": false, "options": {"default": "single", "exec": "exec", "halt": "halt", "single": "single", "suspend": "suspend", "syslog": "syslog", "ignore": "ignore", "ol8": "syslog|single|halt", "rhel8": "syslog|single|halt", "cis_rhel8": "syslog|single|halt", "cis_rhel9": "syslog|single|halt", "cis_rhel10": "syslog|single|halt", "cis_fedora": "syslog|single|halt", "cis_ubuntu2204": "syslog|single|halt", "cis_ubuntu2404": "syslog|single|halt", "cis_debian12": "syslog|single|halt"}, "warnings": [], "title": "Action for auditd to take when disk errors", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var"}