Lion Cipher Lab
Forecast disk exhaustion and alert before logging stops
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
When a log volume fills up, the system has to choose between two bad outcomes: stop recording, or stop working. The Linux audit daemon makes the choice explicit. Its configuration has space_left and admin_space_left thresholds with actions to take as space runs low, and a disk_full_action that can, among other options, suspend logging or halt the system. Log shippers drop events when their buffers fill, and databases and applications fail. Attackers know this: filling a disk is a way to stop the logs that would record what they do next. NIST's log management guidance treats storage capacity…
What you'll learn
- why a full disk is a security problem, not just an outage
- auditd's space_left and disk_full_action settings
- fixed-threshold versus forecast-based alerting
- fitting a linear trend to recent usage
- measuring warning time across growth scenarios
- false alarms from transient spikes, and fixing them
- choosing an alert rule for a log volume
Steps in this lab
- What happens when a log disk fills
- Two alert rules, three scenarios
- Run it: steady growth and the runaway
- The forecast's own failure: a spike
- Choose and deploy a rule