---
title: "HOST-FS-012 Log Directories on the Root Filesystem"
canonical: https://openvapt.com/checks/HOST-FS-012.html
html: https://openvapt.com/checks/HOST-FS-012.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-FS-012 Log Directories on the Root Filesystem

Checks that /var/log (or /var) is a separate filesystem so runaway logging cannot fill the root disk.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-770
- NIST SP 800-53 Rev. 5: CM-6, CM-7, SC-5
- Benchmark topic: Separate partitions and mount options (CIS Controls v8 4.1) (topic only, no benchmark text)

## Why It Matters

Logs grow under attacker influence (failed logins, scanner noise). When they share the root filesystem, filling them stops the whole server, and when the disk is full new security events are lost.

## How It Detects

Reads /proc/mounts (no command is run) and looks for a mount entry for /var/log or /var. Unreadable or partial /proc/mounts is reported as incomplete.

## How to Fix

Place /var/log (and ideally /var/log/audit) on its own partition or logical volume, listed in /etc/fstab with nodev,nosuid,noexec. Caution: moving log directories needs a backup, a maintenance window and console access; stop the logging services while copying, and a wrong /etc/fstab line can stop the boot.

## How to Verify

```
findmnt -no TARGET,OPTIONS /var/log /var
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)
- [P17 Kernel, Filesystem and Boot Hardening](https://openvapt.com/academy/p17.md)

## References

- [mount(8), Linux man-pages (nodev, nosuid, noexec)](https://man7.org/linux/man-pages/man8/mount.8.html)
- [proc(5), Linux man-pages (/proc/[pid]/mounts)](https://man7.org/linux/man-pages/man5/proc.5.html)
- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/files_mounts.go

Run it: `openvapt scan --only HOST-FS-012`. Read it offline: `openvapt explain HOST-FS-012`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-FS-012.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.