Detections
Analytics

1.28 SOL-11.1-010390

Information

The operating system must alert designated organizational officials in the event of an audit processing failure.

GROUP ID: V-216273
RULE ID: SV-216273r958424

Proper alerts to system administrators and IA officials of audit failures ensure a timely response to critical system issues.

Solution

The root role is required.

This action applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this action applies.

Add an audit_warn alias to /etc/mail/aliases that will forward to designated system administrator(s).

# pfedit /etc/mail/aliases

Insert a line in the form:

audit_warn:user1,user2

Put the updated aliases file into service.

# newaliases

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-5a., CAT|I, CCI|CCI-000139, Rule-ID|SV-216273r958424_rule, STIG-ID|SOL-11.1-010390, Vuln-ID|V-216273

Plugin: Unix

Control ID: 60dd3eee9c94a0fca5632642effd96654b5208a0220036f16babb5b356504e8d