The application must initiate session auditing upon startup.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-69419	APSC-DV-000910	SV-84041r1_rule		Medium

Description
If the application does not begin logging upon startup, important log events could be missed.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2017-01-09

Details

Check Text ( C-69837r1_chk )
Examine the application design documentation and interview the application administrator to identify application logging behavior. If the application is writing to an existing log or log file: Open and monitor the application log. Start the application service and view the log entries. Log entries indicating the application is starting should commence as soon as the application starts. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events. If the application writes events to a new log on startup: Identify location logs are written to, start the application and then identify and access the new log. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events. If the application does not begin logging events upon start up, this is a finding.

Check Text ( C-69837r1_chk )

Examine the application design documentation and interview the application administrator to identify application logging behavior.

If the application is writing to an existing log or log file:

Open and monitor the application log.

Start the application service and view the log entries.

Log entries indicating the application is starting should commence as soon as the application starts. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events.

If the application writes events to a new log on startup:

Identify location logs are written to, start the application and then identify and access the new log.

Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events.

If the application does not begin logging events upon start up, this is a finding.

Fix Text (F-75595r1_fix)
Configure the application to begin logging application events as soon as the application starts up.