{{%- if product in ["ol7"] %}}
  {{%- set auditd_conf_path = audisp_conf_path + "/audispd.conf" %}}
{{%- else %}}
  {{%- set auditd_conf_path = audisp_conf_path + "/auditd.conf" %}}
{{%- endif %}}

documentation_complete: true

title: Appropriate Action Must be Setup When the Internal Audit Event Queue is Full

description: |-
    The audit system should have an action setup in the event the internal event queue becomes full.
    To setup an overflow action edit <tt>{{{ auditd_conf_path }}}</tt>. Set <tt>overflow_action</tt>
    to one of the following values: <tt>syslog</tt>, <tt>single</tt>, <tt>halt</tt>.


rationale: |-
    The audit system should have an action setup in the event the internal event queue becomes full
    so that no data is lost.

severity: medium

identifiers:
    cce@rhel8: CCE-85889-4
    cce@rhel9: CCE-87901-5
    cce@rhel10: CCE-87003-0

references:
    nist: AU-4(1)
    srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
    stigid@ol7: OL07-00-030210
    stigid@ol8: OL08-00-030700

ocil_clause: 'auditd overflow action is not set correctly'

ocil: |-
    Verify the audit system is configured to take an appropriate action when the internal event queue is full:
    <pre>$ sudo grep -i overflow_action {{{ auditd_conf_path }}}</pre>

    The output should contain <tt>overflow_action = syslog</tt>

    If the value of the "overflow_action" option is not set to <tt>syslog</tt>,
    <tt>single</tt>, <tt>halt</tt> or the line is commented out, ask the System Administrator
    to indicate how the audit logs are off-loaded to a different system or media.

fixtext: |-
    Configure {{{ full_name }}} to take an appropriate action when the internal audit event queue is full.

    Add or edit the following line in "{{{ auditd_conf_path }}}":

    overflow_action = syslog

    The auditd daemon needs to be restarted in order for changes to take effect.

srg_requirement: |-
    {{{ full_name }}} must take an action when the internal audit event queue is full.
