The operating system must configure auditing to reduce the likelihood of storage capacity being exceeded.

Overflowing the audit storage area can result in a denial of service or system outage.

The Audit Configuration profile is required. This check applies to the global zone only. Determine the zone that is currently being secured. # zonename If the command output is "global", this check applies. Check the status of the audit system. It must be auditing. # pfexec auditconfig -getplugin p_fsize=4M (example output) If the output of this command does not contain a specific file size, this is a finding.

The Audit Control profile is required. This action applies to the global zone only. Determine the zone that is currently being secured. # zonename If the command output is "global", this action applies. Set the size of a binary audit file to a specific size. The size is specified in megabytes. The example below shows “4M” (4 megabytes) as a suggested value. # pfexec auditconfig -setplugin audit_binfile p_fsize=4M Restart the audit system. # pfexec audit -s