On 11/15/13, 2:16 PM, Steinke, Leland J Sr CTR DISA FSO (US) wrote:
- <overlay owner="disastig"
ruleid="configure_auditd_admin_space_left_action"
ownerid="RHEL-06-000163" disa="1343" severity="medium">
+ <overlay owner="disastig" ruleid="nonselected"
ownerid="RHEL-06-000163" disa="1343" severity="medium">
<title>The audit system must switch the system to single-user mode when
available audit storage volume becomes dangerously low.</title>
</overlay>
This is the only thing that caught my eye.
By moving to nonselected, will it no longer be required to switch into
single user mode when /var/log/audit fills up?
From a code perspective, ack.