Back to Checks
kubernetes

API server pod has --audit-log-maxsize set to 100 MB or the configured value

apiserver_audit_log_maxsize_set
Service: apiserverSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:Pod

Kubernetes API server uses --audit-log-maxsize to cap audit log files. The check expects 100 MB or a policy-approved value, indicating rotation occurs when a log reaches that size.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Absent a proper cap, audit logs can grow unchecked, exhausting disk and degrading API server availability. Oversized or unbounded logs impede forensics and may overwrite recent events during rotation, undermining integrity and accountability of audit evidence.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_audit_log_maxsize_set

Recommendation

Set --audit-log-maxsize to 100 MB or your approved baseline to ensure predictable rotation.

Pair with sensible retention (--audit-log-maxage, --audit-log-maxbackup), forward to a central store, and monitor capacity. This enforces defense in depth and preserves reliable auditability.

Remediation

Other

1SSH to the control plane node
2Edit the API server static pod manifest: sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
3In spec.containers[0].command add (or set) this flag:
4- --audit-log-maxsize=100
5Save and exit; the kubelet will restart the API server automatically
6Verify: ps aux | grep kube-apiserver | grep -- "--audit-log-maxsize=100"

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_audit_log_maxsize_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Audit log max size is set appropriately in the API server in pod {pod.name}."
            audit_log_maxsize_set = False
            for container in pod.containers.values():
                audit_log_maxsize_set = False
                # Check if "--audit-log-maxsize" is set to 100 MB or as appropriate
                for command in container.command:
                    if command.startswith("--audit-log-maxsize"):
                        if int(
                            command.split("=")[1]
                        ) == apiserver_client.audit_config.get(
                            "audit_log_maxsize", 100
                        ):
                            audit_log_maxsize_set = True
                            break
                if not audit_log_maxsize_set:
                    break

            if not audit_log_maxsize_set:
                report.status = "FAIL"
                report.status_extended = f"Audit log max size is not set to 100 MB or as appropriate in pod {pod.name}."

            findings.append(report)
        return findings

References