Detections
Analytics

SLES-15-030690 - Audispd must off-load audit records onto a different system or media from the SUSE operating system being audited.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

Solution

Configure the SUSE operating system '/etc/audisp/audisp-remote.conf' file to off-load audit records onto a different system or media by adding or editing the following line with the correct IP address:

remote_server = [IP ADDRESS]

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SLES_15_V1R10_STIG.zip

Item Details

References: CAT|III, CCI|CCI-001851, Rule-ID|SV-234968r877390_rule, STIG-ID|SLES-15-030690, Vuln-ID|V-234968

Plugin: Unix

Control ID: a75ac389db5853c9a0162bc06648c9f2da1b1ed975723cf7152284b83c593daa