JBOS-AS-000195 - JBoss log records must be off-loaded onto a different system or system component a minimum of every seven days.

Information

JBoss logs by default are written to the local file system. A centralized logging solution like syslog should be used whenever possible; however, any log data stored to the file system needs to be off-loaded. JBoss EAP does not provide an automated backup capability. Instead, reliance is placed on OS or third-party tools to back up or off-load the log files.

Protection of log data includes assuring log data is not accidentally lost or deleted. Off-loading log records to a different system or onto separate media from the system the application server is actually running on helps to assure that, in the event of a catastrophic system failure, the log records will be retained.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure the application server to off-load log records every seven days onto a different system or media from the system being logged.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_JBoss_EAP_6-3_V2R4_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9(2), CAT|II, CCI|CCI-001348, Rule-ID|SV-213516r954812_rule, STIG-ID|JBOS-AS-000195, STIG-Legacy|SV-76747, STIG-Legacy|V-62257, Vuln-ID|V-213516

Plugin: Unix

Control ID: fa07d284b9dd78ed2ca5beb129c6d0e66a1e7422a38d4bc91daa9713baaba3a9