SOL-11.1-090220 - The operating system must back up audit records at least every seven days onto a different system or system component than the system or component being audited.

Information

Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on an organizationally defined frequency helps to assure in the event of a catastrophic system failure, the audit records will be retained.

This helps to ensure a compromise of the information system being audited does not also result in a compromise of the audit records.

This requirement can be met by the operating system continuously sending records to a centralized logging server.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

This fix applies to the global zone only. Determine the zone that you are currently securing.

# zonename

If the command output is 'global', this check applies.

The operator shall back up audit records at least every seven days.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_11_x86_V3R1_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9(2), CAT|II, CCI|CCI-001348, Rule-ID|SV-216233r958574_rule, STIG-ID|SOL-11.1-090220, STIG-Legacy|SV-60813, STIG-Legacy|V-47941, Vuln-ID|V-216233

Plugin: Unix

Control ID: b8ff3f8c4911ff72cf442eae2da46411e5fc40fce8c1e0467ce735a6e3be4811