STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

SQL Server must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

DISA Rule

SV-213983r617437_rule

Vulnerability Number

V-213983

Group Title

SRG-APP-000357-DB-000316

Rule Version

SQL6-D0-010900

Severity

CAT II

CCI(s)

• CCI-001849 - The organization allocates audit record storage capacity in accordance with organization-defined audit record storage requirements.

Weight

10

Fix Recommendation

Review the SQL Audit file location, ensure the destination has enough space available to accommodate the maximum total size of all files that could be written.

Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support.

Update the "max_files" parameter of the audits to ensure the correct number of files is defined.

Check Contents

Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive.

SELECT max_file_size, max_rollover_files, log_file_path AS "Audit Path"
FROM sys.server_file_audits

Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties.

If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location or if "max_file_size" or "max_rollover_files" are set to "0" (UNLIMITED), this is a finding.

Vulnerability Number

V-213983

Documentable

False

Rule Version

SQL6-D0-010900

Severity Override Guidance

Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive.

SELECT max_file_size, max_rollover_files, log_file_path AS "Audit Path"
FROM sys.server_file_audits

Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties.

If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location or if "max_file_size" or "max_rollover_files" are set to "0" (UNLIMITED), this is a finding.

Check Content Reference

M

Target Key

3993

Comments