Title

The system must be configured to send audit records to a remote audit server. (Cat III impact)

Discussion

Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host.

Check Content

The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. The vendor (HP) recommends that a script be written to implement a long term strategy for data storage and pass it to the audomon daemon using the "-X <command>" option. <command> is executed each time audomon switches the audit trail. The means used to implement audit log transfer to a remote system will be site specific and therefore always require a manual review. ASK the SA if audomon is configured per the vendor's (HP) guidance to implement a long term, remote data storage strategy.

Fix Text

The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. Create a <command> script to implement the vendor-recommended, long term data storage strategy and pass it to the audomon daemon using the "-X <command>" option. The <command> must be executed each time audomon switches the audit trail. A manual review of the <command> script is required.

Additional Identifiers

Rule ID: SV-38413r1_rule

Vulnerability ID: V-24357

Group Title: GEN002870

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.