documentation_complete: true

title: 'Ensure /var/log/oauth-apiserver Located On Separate Partition'


platform: ocp4-node

description: |-
    OpenShift OAuth server audit logs are stored in the
    <tt>/var/log/oauth-apiserver</tt> directory.
    {{{ partition_description(part="/var/log/oauth-apiserver") }}}

rationale: |-
    Placing <tt>/var/log/oauth-apiserver</tt> in its own partition
    enables better separation between OpenShift OAuth server audit
    files and other log files, and helps ensure that
    auditing cannot be halted due to the partition running out
    of space.

severity: medium

identifiers:
    cce@ocp4: CCE-85954-6

references:
    nist: AU-4
    pcidss: Req-10.5.3,Req-10.5.4
    srg: SRG-APP-000357-CTR-000800

{{{ complete_ocil_entry_separate_partition(part="/var/log/oauth-apiserver") }}}

# (jhrozek): at the moment, the mount probe checks the /proc filesystem
# even if openscap looks at a chroot, which doesn't allow to check for
# mount points when checking RHCOS4 via CO
{{% if product != "ocp4" %}}
template:
    name: mount
    vars:
        mountpoint: /var/log/oauth-apiserver
{{% endif %}}
