← Back to VMware vRealize Automation 7.x SLES Security Technical Implementation Guide

V-240503

CAT III (Low)

The SLES for vRealize must off-load audit records onto a different system or media from the system being audited.

Rule ID

SV-240503r877390_rule

STIG

VMware vRealize Automation 7.x SLES Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-001851

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.

Check Content

Check the syslog configuration file for remote syslog servers:

# cat /etc/syslog-ng/syslog-ng.conf | grep logserver

If no line is returned, or "logserver" is commented out, this is a finding.

Fix Text

Edit the syslog configuration file and add an appropriate remote syslog server:

In the /etc/syslog-ng/syslog-ng.conf file, the remote logging entries must be uncommented and the IP address must be modified to point to the remote syslog server:

# 
# Enable this and adopt IP to send log messages to a log server. 
# 
destination logserver { udp("x.x.x.x" port(514)); };
log { source(src); destination(logserver); };

Note: Replace x.x.x.x with the appropriate IP address.