Rule ID
SV-45755r1_rule
Version
V1R12
CCIs
Monitoring and recording successful and unsuccessful logins assists in tracking unauthorized access to the system.
Check /etc/rsyslog.conf and verify the auth facility is logging both the notice and info level messages by: # grep “auth.notice” /etc/rsyslog.conf # grep “auth.info” /etc/rsyslog.conf or # grep 'auth.*' /etc/rsyslog.conf If auth.* is not found, and either auth.notice or auth.info is not found, this is a finding.
Edit /etc/rsyslog.conf and add local log destinations for auth.* or both auth.notice and auth.info.