Detections
Analytics

1.156 SLES-15-030690

Information

Audispd must off-load audit records onto a different system or media from the SUSE operating system being audited.

GROUP ID: V-234968
RULE ID: SV-234968r1009570

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

Solution

Configure the SUSE operating system "/etc/audit/audisp-remote.conf" file to off-load audit records onto a different system or media by adding or editing the following line with the correct IP address:

remote_server = [IP ADDRESS]

See Also

https://workbench.cisecurity.org/benchmarks/23779

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CAT|III, CCI|CCI-001851, Rule-ID|SV-234968r1009570_rule, STIG-ID|SLES-15-030690, Vuln-ID|V-234968

Plugin: Unix

Control ID: cb95a9e1d8ad1d924b1c80461a0125fbd0743fe38a09ca2ee344b21be44e9956