V-286230

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. MariaDB writes audit records to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system. Satisfies: SRG-APP-000515-DB-000318, SRG-APP-000745-DB-000120

Check Content

MariaDB can be configured to use syslog or any OS system file to store audit records to designated disk directories.

Check the MariaDB Plugin configuration. Check the log file location. As the DBA (root), run the following SQL:

SHOW GLOBAL VARIABLES like  'server_audit%; 

Verify the server_audit_logging is set to "ON".

##To use system logs (syslog): 
     From the query above verify the value of:
       server_audit_output_type=SYSLOG

##To use an OS file:
     From the query above verify the value of:
       server_audit_output_type=FILE
 
Check the following values:

server_audit_file_rotate_now = ON 
server_audit_file_rotate_size x*1024. This is the size of the file (in bytes) that will cause file rotation.
server_ audit_file_rotations =x   This is the number of rotations to save.

Check with the security guide to verify that the central management system is using the correct directories.

If MariaDB audit records are not written directly to or systematically transferred to the centralized log management system in the security guide, this is a finding.

If the DBMS has a continuous network connection to the centralized log management system, but the DBMS audit records are not written directly to the centralized log management system or transferred in near-real-time, this is a finding.

If the DBMS does not have a continuous network connection to the centralized log management system, and the DBMS audit records are not transferred to the centralized log management system weekly or more often, this is a finding.