The application server must generate log records containing information that establishes the identity of any individual or process associated with the event.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35182	SRG-APP-000100-AS-000063	SV-46469r3_rule		Medium

Description
Information system logging capability is critical for accurate forensic analysis. Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Application servers have differing levels of logging capabilities that can be specified by setting a verbosity level. The application server must, at a minimum, be capable of establishing the identity of any user or process that is associated with any particular event.

Description

Information system logging capability is critical for accurate forensic analysis. Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Application servers have differing levels of logging capabilities that can be specified by setting a verbosity level. The application server must, at a minimum, be capable of establishing the identity of any user or process that is associated with any particular event.

STIG	Date
Application Server Security Requirements Guide	2018-01-08

Details

Check Text ( C-43562r2_chk )
Review application server documentation and the log files on the application server to determine if the logs contain information that establishes the identity of the user or process associated with log event data. If the application server does not produce logs that establish the identity of the user or process associated with log event data, this is a finding.

Fix Text (F-39730r2_fix)
Configure the application server logging system to log the identity of the user or process related to the events.