Response to Audit Logging Process Failures AU-5

Source: NIST SP 800-53 Rev.5, Audit and Accountability family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AU-5 (Response to Audit Logging Process Failures) is about what the server does when logging itself breaks — the disk is full, the log service stops, or records cannot be written. The control asks you to alert the right people quickly and to decide, ahead of time, what the system should do. It is an Audit and Accountability control in the Low baseline.

What good looks like

• Decide what counts as a logging failure on this server (log service down, disk full, write errors) so you can actually detect it.
• Alert a named person or role when logging fails, within a time you set — do not let a silent failure sit for days.
• Decide the action to take on failure in advance: keep running, stop, or overwrite the oldest logs — and write that choice down.
• Make the alert reach somewhere a human will see it — email, a monitoring dashboard, or a ticket.
• Test the response so you know the alert really fires when logging breaks.

Framework mapping

How to move it toward Implemented

• Confirm the logging service is up and set to restart: systemctl status rsyslog (or auditd), then systemctl enable --now.
• Add a disk-space and service check (a cron job or a systemd OnFailure= unit) that emails or tickets a named owner when logging stops or /var/log fills.
• For the audit daemon, set the failure behavior in /etc/audit/auditd.conf (for example disk_full_action and admin_space_left_action) so the response is decided in advance.
• Attach the alert setup and config as hardening evidence on the asset, naming AU-5 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.