Detections
Analytics

1.106 MADB-10-012400

Information

MariaDB must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.

GROUP ID: V-253776
RULE ID: SV-253776r961860

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

MariaDB writes audit records to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.

Solution

To set up the audit logs to write to sylog :

Edit the mariadb-enterprise.cnf file. Add the following under the [mariadb] section:

server_audit_output_type = 'syslog'

After the .cnf file is updated and saved, the mariadb database service must be restarted.

See Also

https://workbench.cisecurity.org/benchmarks/26720

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CCI|CCI-001851, Rule-ID|SV-253776r961860_rule, STIG-ID|MADB-10-012400, Vuln-ID|V-253776

Plugin: MySQLDB

Control ID: 506ed00c3b4731933ea546808c19289a7dc2fce83e9ac8431ee4e4b9ba8f4a23