Detections
Analytics
ALMA-09-053040 - AlmaLinux OS 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.
Information
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Off-loading is a common process in information systems with limited audit storage capacity.
Solution
Configure AlmaLinux OS 9 to offload audit records onto a different system or media from the system being audited via TCP using rsyslog by specifying the remote logging server in "/etc/rsyslog.conf"" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server.*.* @@[server]:[port]"
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CL_AlmaLinux_OS_9_V1R6_STIG.zip
Item Details
Audit Name: DISA Cloud Linux AlmaLinux OS 9 STIG v1r6
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|III, CCI|CCI-001851, Rule-ID|SV-269517r1050400_rule, STIG-ID|ALMA-09-053040, Vuln-ID|V-269517
Plugin: Unix
Control ID: ed34f7635284d3b68108b291b8f23d1c68b3e4f81af412deb2cc07ccac91575e