Rule ID
SV-288205r1252753_rule
Version
V1R0.1
CCIs
If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.
Review the application documentation and deployed configuration to determine whether the application's auditing mechanism initiates session auditing upon startup. If the application's auditing mechanism does not initiate session auditing upon startup, this is a finding.
Navigate to the auditing function configuration within the application. Configure the application's auditing mechanism to initiate session auditing upon startup.