openstack/ansible-hardening
Code Issues Proposed changes
Files
6fbe43adf1771a9c8201498baedc81f5d3d0a95f
ansible-hardening/doc/source/developer-notes/V-38468.rst
Major Hayden d31fe3188d Removing equal signs in docs 
This patch removes some documentation errors where equal signs
were used instead of colons.

Change-Id: I362ad1244932124cc8eaa27624aae8f19d4888b9
(cherry picked from commit 6f8b686fe5)
2016-05-09 12:23:37 +00:00

847 B
Raw Blame History

Ubuntu's default for disk_full_action is SUSPEND, which actually only suspends audit logging. That could be a security issue, so SYSLOG is recommended and is set by default by openstack-ansible-security. If syslog messages are being sent to remote servers, these log messages should alert an administrator about the disk being full. There are additional options available, like EXEC, SINGLE or HALT.

To configure a different disk_full_action, set the following Ansible variable:

disk_full_action: SYSLOG

For details on available settings and what they do, run man auditd.conf. Some options can cause the host to go offline until the issue is fixed. Deployers are urged to carefully read the auditd documentation prior to changing the disk_full_action setting from the default.