Detections
Analytics

1.10 UBTU-24-100200

Information

The operating system must be configured to preserve log records from failure events.

GROUP ID: V-270653
RULE ID: SV-270653r1067141

Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system.

Preserving operating system state information helps to facilitate operating system restart and return to the operational mode of the organization with least disruption to mission/business processes.

Solution

Install the log service by using the following command:

$ sudo apt-get install rsyslog

Enable and activate the log service by using the following command:

$ sudo systemctl enable rsyslog.service --now

See Also

https://workbench.cisecurity.org/benchmarks/22775

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-24, CAT|II, CCI|CCI-001665, CSCv7|6.2, CSCv7|6.3, Rule-ID|SV-270653r1067141_rule, STIG-ID|UBTU-24-100200, Vuln-ID|V-270653

Plugin: Unix

Control ID: 777679911134a98ef36e73bec2d62a2f05446c844b90f096d3f5b530b8e0c442