The Oracle Linux operating system must use a separate file system for the system audit data path large enough to hold at least one week of audit data.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
low	V-221756	SRG-OS-000341-GPOS-00132	OL07-00-021330	SV-221756r958752_rule	2025-02-20	3

Description
The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.

ℹ️ Check
Determine if the operating system is configured to have the "/var/log/audit" path is on a separate file system. # grep /var/log/audit /etc/fstab If no result is returned, or the operating system is not configured to have "/var/log/audit" on a separate file system, this is a finding. Verify that "/var/log/audit" is mounted on a separate file system: # mount \| grep "/var/log/audit" If no result is returned, or "/var/log/audit" is not on a separate file system, this is a finding. Verify the size of the audit file system: # df -h /var/log/audit If the size is insufficient for a week of audit data, this is a finding.

ℹ️ Check

Determine if the operating system is configured to have the "/var/log/audit" path is on a separate file system. # grep /var/log/audit /etc/fstab If no result is returned, or the operating system is not configured to have "/var/log/audit" on a separate file system, this is a finding. Verify that "/var/log/audit" is mounted on a separate file system: # mount | grep "/var/log/audit" If no result is returned, or "/var/log/audit" is not on a separate file system, this is a finding. Verify the size of the audit file system: # df -h /var/log/audit If the size is insufficient for a week of audit data, this is a finding.

✔️ Fix
Migrate the system audit data path onto an appropriately sized separate file system to store at least one week of audit records.