Detections
Analytics

SLES-15-030790 - The SUSE operating system must off-load audit records onto a different system or media from the system being audited.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

Solution

Configure the SUSE operating system to take the appropriate action if it cannot off-load audit records to a different system or storage media from the system being audited due to a network failure.

Uncomment the 'network_failure_action' option in '/etc/audisp/audisp-remote.conf' and set it to 'syslog', 'single', or 'halt'. See the example below:

network_failure_action = syslog

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SLES_15_V1R10_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001851, Rule-ID|SV-234978r854270_rule, STIG-ID|SLES-15-030790, Vuln-ID|V-234978

Plugin: Unix

Control ID: 707aa8acbd861ab19d915ab5e6cd59d19b389c2e94a20a5e089b930ac50effe8