Detections
Analytics
SLEM-05-652010 - SLEM 5 must offload rsyslog messages for networked systems in real time and offload standalone systems at least weekly.
Information
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Offloading is a common process in information systems with limited audit storage capacity.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Configure SLEM 5 to offload syslog-ng messages for networked systems in real time.For standalone systems establish a procedure to offload log messages at least once a week.
For networked systems add a "UDP_OR_TCP("IP_ADDRESS" port(514)); };"
"#log { source(src); destination(logserver); };" in "/etc/syslog-ng/syslog-ng.conf" that does not have one.
syslog("10.10.10.10" transport("udp") port(514)); };
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SLEM_5_V1R4_STIG.zip
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-261409r996643_rule, STIG-ID|SLEM-05-652010, Vuln-ID|V-261409
Plugin: Unix
Control ID: 5f337662b8e851fd0baf1ecfb2e3ed841b80c76d2228bc5b4aeb4a142a176e00