Detections
Analytics

1.162 SLES-15-030790

Information

The SUSE operating system must off-load audit records onto a different system or media from the system being audited.

GROUP ID: V-234978
RULE ID: SV-234978r1009573

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

Solution

Configure the SUSE operating system to take the appropriate action if it cannot off-load audit records to a different system or storage media from the system being audited due to a network failure.

Uncomment the "network_failure_action" option in "/etc/audit/audisp-remote.conf" and set it to "syslog", "single", or "halt". See the example below:

network_failure_action = syslog

See Also

https://workbench.cisecurity.org/benchmarks/23779

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-234978r1009573_rule, STIG-ID|SLES-15-030790, Vuln-ID|V-234978

Plugin: Unix

Control ID: 57ccfcfe6b8bedf421e16784c323ef8b935a01cd2fd7206ffe8bb0d5280f8ded