securing oracle linux 9 article 25 auditd service and log retention

وحید نوروزی سیستم عامل و زیرساخت 31 July 2026 Hits: 9

In the previous part, Managing Log File Access was completed.

1. CIS Benchmark Requirements (Sections 6.3.1 and 6.3.2)

This article focuses on installing, enabling, and configuring auditd service data retention.

6.3.1 Configure auditd Service
6.3.1.1 Ensure auditd packages are installed
6.3.1.2 Ensure auditing for processes that start prior to auditd is enabled (audit=1)
6.3.1.3 Ensure audit_backlog_limit is sufficient
6.3.1.4 Ensure auditd service is enabled and active
6.3.2 Configure Data Retention
6.3.2.1 Ensure audit log storage size is configured (max_log_file)
6.3.2.2 Ensure audit logs are not automatically deleted (max_log_file_action)
6.3.2.3 Ensure system is disabled when audit logs are full (space_left_action, admin_space_left_action)
6.3.2.4 Ensure system warns when audit logs are low on space (space_left)

2. Concept and Security Rationale

The auditd service is the primary auditing tool in Linux and records security-related events. To ensure that processes starting before the auditd service are also audited, the audit=1 and audit_backlog_limit=8192 parameters must be configured in GRUB.

To prevent audit logs from being lost, the log file size must be configured and automatic deletion must be disabled. From a security perspective, the standard recommends that the system issue a warning or stop when the log disk becomes full. This helps prevent an attacker from performing actions without those activities being recorded.

3. Oracle Database Compatibility Review (RAC and Grid)

Critical interference and availability risk: Requirement 6.3.2.3 requires the system to stop when the audit logs become full, using admin_space_left_action = halt or single. Stopping the operating system on Oracle Database production servers, especially in RAC environments, causes severe downtime and may result in cluster node eviction.

Implementation solution and requirements: For Oracle servers, the space_left_action and admin_space_left_action parameters in /etc/audit/auditd.conf should be configured as SYSLOG, EMAIL, or EXEC for executing a temporary cleanup script. This sends a warning instead of shutting down the server and helps preserve database service availability.

A separate, dedicated partition with sufficient capacity for /var/log/audit/ is essential. This prevents the audit logs from rapidly consuming space on the root partition.

4. Auditing the Current Configuration

The path of this script in GitHub is: modules/audit_25_Auditd_Service_Log_Retention.sh

If you are not familiar with Bash scripting, you may refer to the Bash for Oracle DBAs training published for database administrators.

#!/bin/bash
# Script: audit25.sh
# Purpose: Audit CIS 6.3.1 & 6.3.2 (Auditd Configuration & Retention)

echo "=========================================================================="
echo " CIS Requirement: Configure auditd Service and Data Retention"
echo "--------------------------------------------------------------------------"
echo " Oracle Context & Exceptions:"
echo " - CRITICAL INTERFERENCE: CIS recommends HALT/SINGLE for space_left_action."
echo " - EXPLANATION: In Oracle DB/RAC environments, halting the OS due to full"
echo "   audit logs causes node eviction and database downtime."
echo " - SOLUTION: Set space_left_action and admin_space_left_action to SYSLOG."
echo "=========================================================================="

AUDIT_STATUS="PASS"

# 1. Packages & Service
if rpm -q audit audit-libs >/dev/null 2>&1; then
    echo "[ PASS ] Packages 'audit' and 'audit-libs' are installed."
else
    echo "[ FAIL ] Packages 'audit' and 'audit-libs' are not installed."
    AUDIT_STATUS="FAIL"
fi

if systemctl is-active auditd >/dev/null 2>&1; then
    echo "[ PASS ] auditd service is active."
else
    echo "[ FAIL ] auditd service is not active."
    AUDIT_STATUS="FAIL"
fi

if systemctl is-enabled auditd >/dev/null 2>&1; then
    echo "[ PASS ] auditd service is enabled."
else
    echo "[ FAIL ] auditd service is not enabled."
    AUDIT_STATUS="FAIL"
fi

# 2. GRUB Configuration
if grubby --info=ALL | grep -q "audit=1"; then
    echo "[ PASS ] GRUB parameter 'audit=1' is present."
else
    echo "[ FAIL ] GRUB parameter 'audit=1' is missing."
    AUDIT_STATUS="FAIL"
fi

if grubby --info=ALL | grep -q "audit_backlog_limit="; then
    echo "[ PASS ] GRUB parameter 'audit_backlog_limit' is present."
else
    echo "[ FAIL ] GRUB parameter 'audit_backlog_limit=' is missing."
    AUDIT_STATUS="FAIL"
fi

# 3. Data Retention Configuration
check_audit_conf() {
    local key=$1
    local expected=$2
    local current=$(grep -E "^${key}\s*=" /etc/audit/auditd.conf | awk -F= '{print $2}' | tr -d ' ')
    if [ "$current" != "$expected" ]; then
         echo "[ FAIL ] auditd.conf: $key is '$current' (Expected: $expected)"
         AUDIT_STATUS="FAIL"
    else
         echo "[ PASS ] auditd.conf: $key is correctly set to '$current'"
    fi
}

check_audit_conf "max_log_file" "24"
check_audit_conf "max_log_file_action" "keep_logs"
check_audit_conf "space_left_action" "SYSLOG"
check_audit_conf "admin_space_left_action" "SYSLOG"

echo "----------------------------------------------------------"
if [ "$AUDIT_STATUS" == "PASS" ]; then
    echo -e "\e[32m[ PASS ] Final Status: Section 25 Auditing Passed Successfully.\e[0m"
else
    echo -e "\e[31m[ FAIL ] Final Status: Section 25 Auditing Failed. Run remediation script.\e[0m"
fi
echo "=========================================================="

5. Applying the Configuration (Remediation Bash Script)

The path of this script in GitHub is: modules/remediate_25_Auditd_Service_Log_Retention.sh

#!/bin/bash
if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit 1; fi

# 6.3.1.1
dnf install -y audit audit-libs

# 6.3.1.4
systemctl enable --now auditd

# 6.3.1.2 & 6.3.1.3 (GRUB)
grubby --update-kernel=ALL --args="audit=1 audit_backlog_limit=8192"

# 6.3.2 Data Retention (/etc/audit/auditd.conf)
sed -i 's/^max_log_file .*/max_log_file = 24/' /etc/audit/auditd.conf
sed -i 's/^max_log_file_action .*/max_log_file_action = keep_logs/' /etc/audit/auditd.conf
sed -i 's/^space_left .*/space_left = 25%/' /etc/audit/auditd.conf
# Note for Oracle: using SYSLOG instead of halt to prevent DB downtime
sed -i 's/^space_left_action .*/space_left_action = SYSLOG/' /etc/audit/auditd.conf
sed -i 's/^admin_space_left_action .*/admin_space_left_action = SYSLOG/' /etc/audit/auditd.conf

# Restart service
service auditd restart

In the next part, we will cover Configuring Auditd Rules .