V-253937

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Archiving is not required unless space is limited in the audit server.

Check Content

Verify an external syslog server is configured. The lowest severity level, "any", is debug and will generate a significant number of messages.

[edit system syslog]
host <external syslog address> {
    any info;
    structured-format; << Only if structured formatting is required, otherwise events are recorded in standard format.
}
time-format year;


If the device does not offload audit records to an external syslog server, this is a finding.