Detections
Analytics

5.3 Ensure that logging captures as much information as possible

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The SystemLog.quiet option stops logging of information such as:

 - connection events
 - authentication events
 - replication sync activities
 - evidence of some potentially impactful commands being run (eg: drop, dropIndexes, validate )

This information should be logged whenever possible. This check is only for Enterprise editions.

The use of SystemLog.quiet makes troubleshooting problems and investigating possible security incidents much more difficult.

Solution

Set

`SystemLog:
 quiet: false`

to false in the /etc/mongod.conf file to disable it.

See Also

https://workbench.cisecurity.org/benchmarks/19909

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: 14fd33d5ddb2dcdb667988331ca76a256590b4adc417919bf7b33bb52f29bcfc