Information
Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. Create a <command> script to implement the vendor-recommended, long term data storage strategy and pass it to the audomon daemon using the '-X <command>' option. The <command> must be executed each time audomon switches the audit trail.
A manual review of the <command> script is required.