Detections
Analytics
JBOS-AS-000735 - JBoss servers must be configured to roll over and transfer logs on a minimum weekly basis.
Information
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Protecting log data is important during a forensic investigation to ensure investigators can track and understand what may have occurred. Off-loading should be set up as a scheduled task but can be configured to be run manually, if other processes during the off-loading are manual.Off-loading is a common process in information systems with limited log storage capacity.
Solution
Open the web-based management interface by opening a browser and pointing it to HTTPS://<EAP_SERVER>:9990/Authenticate as a user with Admin rights.
Navigate to the 'Configuration' tab.
Expand + Subsystems.
Expand + Core.
Select 'Logging'.
Select the 'Handler' tab.
Select 'Periodic'.
If a periodic file handler does not exist, reference JBoss admin guide for instructions on how to create a file handler that will rotate logs on a daily basis.
Create scripts that package and off-load log data at least weekly.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_JBoss_EAP_6-3_V2R6_STIG.zip
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-213559r961860_rule, STIG-ID|JBOS-AS-000735, STIG-Legacy|SV-76835, STIG-Legacy|V-62345, Vuln-ID|V-213559
Plugin: Unix
Control ID: da7bfa778a487928e2e72a7342388fcb00bcb08c0a2deff1fc55f3ca4b814040