Detections
Analytics
SLES-15-030690 - Audispd must off-load audit records onto a different system or media from the SUSE operating system being audited.
Information
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Off-loading is a common process in information systems with limited audit storage capacity.
Solution
Configure the SUSE operating system "/etc/audit/audisp-remote.conf" file to off-load audit records onto a different system or media by adding or editing the following line with the correct IP address:remote_server = [IP ADDRESS]
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SLES_15_V2R6_STIG.zip
Item Details
Audit Name: DISA SUSE Linux Enterprise Server 15 STIG v2r6
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|III, CCI|CCI-001851, Rule-ID|SV-234968r1009570_rule, STIG-ID|SLES-15-030690, Vuln-ID|V-234968
Plugin: Unix
Control ID: da1ba672984ce0d2775f0714abaf77933ed2d1ff279553ad23f82e31f6c6d4f1