V-283776

Discussion

To ensure network devices have a sufficient storage capacity in which to write the audit logs, they must be able to allocate audit record storage capacity. The task of allocating audit record storage capacity is usually performed during initial device setup if it can be modified. The value for the organization-defined audit record storage requirement will depend on the amount of storage available on the network device, the anticipated volume of logs, the frequency of transfer from the network device to centralized log servers, and other factors.

Check Content

Verify the log size complies with organization-defined audit record storage using the command below:

- show log log-id

Event Logs

Name
Log     Source     Filter     Admin     Oper     Logged     Dropped     Dest            Dest Size
Id        Id                              State         State                        Type             Id

101     M S C         N/A       up              up          1420         0                    netconf      500

If the log size does not meet organization-defined audit record storage requirements, this is a finding.