The Central Log Server that aggregates log records from hosts and devices must be configured to use TCP for transmission to guarantee delivery.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-81181	SRG-APP-000516-AU-000340	SV-95895r1_rule		Medium

Description
If the default UDP protocol is used for communication between the hosts and devices to the Central Log Server, then log records that do not reach the log server are not detected as a data loss. The use of TCP to transport log records to the log servers guarantees delivery and gives the option to encrypt the traffic if the log server communication is not protected using a management network (preferred) or VPN based on mission requirements.

Description

If the default UDP protocol is used for communication between the hosts and devices to the Central Log Server, then log records that do not reach the log server are not detected as a data loss. The use of TCP to transport log records to the log servers guarantees delivery and gives the option to encrypt the traffic if the log server communication is not protected using a management network (preferred) or VPN based on mission requirements.

STIG	Date
Central Log Server Security Requirements Guide	2018-08-29

Details

Check Text ( C-80847r1_chk )
Examine the configuration. Verify the Central Log Server is configured to use TCP to guarantee delivery. If the Central Log Server is not configured to use TCP to guarantee delivery, this is a finding.

Fix Text (F-87957r1_fix)
Configure the Central Log Server that aggregates log records from hosts and devices to use TCP for transmission to guarantee delivery.