UBTU-18-010022 - The Ubuntu operating system must be configured to preserve log records from failure events.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

Information

Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system.

Preserving operating system state information helps to facilitate operating system restart and return to the operational mode of the organization with least disruption to mission/business processes.

Solution

Configure the log service to collect failure events.

Install the log service (if the log service is not already installed) with the following command:

# sudo apt-get install rsyslog

Enable the log service with the following command:

# sudo systemctl enable rsyslog

Restart the log service with the following command:

# sudo systemctl restart rsyslog

Item Details

Audit Name: DISA STIG Ubuntu 18.04 LTS v2r14

Plugin: Unix

Control ID: e098c43547aa2c10f99d98a863f6bcfc15a6185309355111b6d7e8cc033058d2

Detections

Analytics

UBTU-18-010022 - The Ubuntu operating system must be configured to preserve log records from failure events.

Warning! Audit Deprecated

Information

Solution

See Also

Item Details