Skip to main content

Configuring Audit Settings on Red Hat

Hands-On Lab

 

Photo of Bob Salmans

Bob Salmans

Training Architect

Length

00:30:00

Difficulty

Intermediate

In this lab, we will take a look at setting up auditing services on a Red Hat host. We will configure low space email alerting, limit logging space used, and limit the number of audit buffers. The overall goal of this lab is to control the amount of space our audit logs are using and to use email alerting in order to prevent a partition from filling up.

What are Hands-On Labs?

Hands-On Labs are scenario-based learning environments where learners can practice without consequences. Don't compromise a system or waste money on expensive downloads. Practice real-world skills without the real-world risk, no assembly required.

Configuring Audit Settings on Red Hat

Introduction

In this lab, we will take a look at setting up auditing services on a Red Hat host. We will configure low space email alerting, limit logging space used, and limit the number of audit buffers.

Solution

  1. Begin by logging in to the lab server using the credentials provided on the hands-on lab page:

    ssh cloud_user@PUBLIC_IP_ADDRESS
  2. Become the root user:

    sudo su

Configure the auditd service to start automatically at boot

  1. Run the following command to ensure auditd starts automatically at boot:

    systemctl enable auditd

Set up low disk space email alerts

  1. Edit the /etc/audit/auditd.conf file and set:
    • space_left = 100
    • space_left_action = email

Restrict the disk space used by the audit logs

  1. Edit the /etc/audit/auditd.conf file and set the max_log_file and the num_logs values so their multiplied value is equal to 300 (MB).
    • max_log_file = 10
    • num_logs = 30

Limit the number of audit buffers used by the system

  1. Edit the file /etc/audit/rules.d/audit.rules and set the buffer size:

    Change:

    -b 8192

    To:

    -b 5120
  2. Lastly, restart the auditd service

    service auditd restart

Conclusion

Congratulations — you've completed this hands-on lab!