On 11/15/13, 2:16 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
<overlay owner="disastig" ruleid="configure_auditd_admin_space_left_action" ownerid="RHEL-06-000163" disa="1343" severity="medium">
<overlay owner="disastig" ruleid="nonselected" ownerid="RHEL-06-000163" disa="1343" severity="medium"> <title>The audit system must switch the system to single-user mode when available audit storage volume becomes dangerously low.</title> </overlay>
This is the only thing that caught my eye.
By moving to nonselected, will it no longer be required to switch into single user mode when /var/log/audit fills up?
From a code perspective, ack.