Detections
Analytics
SLEM-05-653040 - SLEM 5 must offload audit records onto a different system or media from the system being audited.
Information
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Offloading is a common process in information systems with limited audit storage capacity.
Solution
Configure SLEM 5 to take the appropriate action if it cannot offload audit records to a different system or storage media from the system being audited due to a network failure.Add or modify the following line in the "/etc/audisp/audisp-remote.conf" file:
network_failure_action = syslog
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SLEM_5_V1R4_STIG.zip
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-261416r996660_rule, STIG-ID|SLEM-05-653040, Vuln-ID|V-261416
Plugin: Unix
Control ID: 3411ba410e5a320221a64b39e3787d660ec4ab7f93eabfaea2f480ae5f183883