Audit Log Storage Capacity AU-4

Audit and Accountability · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AU-4 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AU-4 (Audit Log Storage Capacity) is about making sure the server has enough room set aside for logs so they do not fill up and start dropping records. If the log area runs out of space, you lose the very evidence you are trying to keep. It is an Audit and Accountability control in the Low baseline.

What good looks like

Size the log storage to your retention need — decide how many days or weeks of logs you must keep, then make sure the disk can hold that much.
Keep logs on enough free space (or their own partition) so a flood of entries cannot fill the whole system disk.
Set rotation and retention so old logs are compressed or archived before space runs out.
Watch the disk so you get a heads-up before the log area fills, not after.
Match the capacity to the retention requirement in your AU-1 policy — the two should agree.

Framework mapping

CIS Controls v8 — Control 8 — Audit Log Management

How to move it toward Implemented

Check current log usage and free space: du -sh /var/log and df -h /var/log.
Tune retention in /etc/logrotate.conf (and the files under /etc/logrotate.d/), and cap the systemd journal with SystemMaxUse= in /etc/systemd/journald.conf.
Consider giving /var/log its own partition or volume so log growth cannot crowd out the rest of the system.
Attach the sizing check and config as hardening evidence on the asset, naming AU-4 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.