Title

The application must initiate session auditing upon startup. (Cat II impact)

Discussion

If the application does not begin logging upon startup, important log events could be missed.

Check Content

Examine the application design documentation and interview the application administrator to identify application logging behavior. If the application is writing to an existing log or log file: Open and monitor the application log. Start the application service and view the log entries. Log entries indicating the application is starting should commence as soon as the application starts. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events. If the application writes events to a new log on startup: Identify location logs are written to, start the application and then identify and access the new log. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events. If the application does not begin logging events upon start up, this is a finding.

Fix Text

Configure the application to begin logging application events as soon as the application starts up.

Additional Identifiers

Rule ID: SV-222468r960888_rule

Vulnerability ID: V-222468

Group Title: SRG-APP-000092

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.