Detections
Analytics

1.207 SOL-11.1-090220

Information

The operating system must back up audit records at least every seven days onto a different system or system component than the system or component being audited.

GROUP ID: V-216469
RULE ID: SV-216469r958574

Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on an organizationally defined frequency helps to assure in the event of a catastrophic system failure, the audit records will be retained.

This helps to ensure a compromise of the information system being audited does not also result in a compromise of the audit records.

This requirement can be met by the operating system continuously sending records to a centralized logging server.

Solution

This fix applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is "global", this check applies.

The operator shall back up audit records at least every seven days.

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9(2), CAT|II, CCI|CCI-001348, Rule-ID|SV-216469r958574_rule, STIG-ID|SOL-11.1-090220, Vuln-ID|V-216469

Plugin: Unix

Control ID: b429626245569fbdb346adbb75e73320e6b419341b0b1f5fd06ef74e3c85f2a8