STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The operating system must back up audit records on an organization defined frequency onto a different system or media than the system being audited.

DISA Rule

SV-208873r603263_rule

Vulnerability Number

V-208873

Group Title

SRG-OS-000215

Rule Version

OL6-00-000136

Severity

CAT II

CCI(s)

• CCI-001348 - The information system backs up audit records on an organization-defined frequency onto a different system or system component than the system or component being audited.

Weight

10

Fix Recommendation

To configure rsyslog to send logs to a remote log server, open "/etc/rsyslog.conf" and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting "[loghost.example.com]" appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments.
To use UDP for log message delivery:

*.* @[loghost.example.com]

To use TCP for log message delivery:

*.* @@[loghost.example.com]

To use RELP for log message delivery:

*.* :omrelp:[loghost.example.com]

Check Contents

To ensure logs are sent to a remote host, examine the file "/etc/rsyslog.conf". If using UDP, a line similar to the following should be present:

*.* @[loghost.example.com]

If using TCP, a line similar to the following should be present:

*.* @@[loghost.example.com]

If using RELP, a line similar to the following should be present:

*.* :omrelp:[loghost.example.com]

If none of these are present, this is a finding.

Vulnerability Number

V-208873

Documentable

False

Rule Version

OL6-00-000136

Severity Override Guidance

To ensure logs are sent to a remote host, examine the file "/etc/rsyslog.conf". If using UDP, a line similar to the following should be present:

*.* @[loghost.example.com]

If using TCP, a line similar to the following should be present:

*.* @@[loghost.example.com]

If using RELP, a line similar to the following should be present:

*.* :omrelp:[loghost.example.com]

If none of these are present, this is a finding.

Check Content Reference

M

Target Key

2928

Comments