Audit logs must be rotated daily.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4357	GEN002860	SV-4357r7_rule	ECSC-1	Medium

Description
Rotate audit logs daily to preserve audit file system space and to conform to the DISA requirement. If it is not rotated daily and moved to another location, then there is more of a chance for the compromise of audit data by malicious users.

STIG	Date
Draft AIX Security Technical Implementation Guide	2011-08-17

Details

Check Text ( C-8278r2_chk )
Check for any crontab entries that rotate audit logs. Procedure: # crontab –l If such a cron job is found, this is not a finding. Otherwise, query the SA. If there is a process that automatically rotates audit logs, this is not a finding. If the SA manually rotates audit logs, this is still a finding, because if the SA is not there, it will not be accomplished. If the audit output is not archived daily, to tape or disk, this is a finding. This can be ascertained by looking at the audit log directory and, if more than one file is there, or if the file does not have today’s date, this is a finding.

Check Text ( C-8278r2_chk )

Check for any crontab entries that rotate audit logs.
Procedure:
# crontab –l
If such a cron job is found, this is not a finding.

Otherwise, query the SA. If there is a process that automatically rotates audit logs, this is not a finding. If the SA manually rotates audit logs, this is still a finding, because if the SA is not there, it will not be accomplished. If the audit output is not archived daily, to tape or disk, this is a finding. This can be ascertained by looking at the audit log directory and, if more than one file is there, or if the file does not have today’s date, this is a finding.

Fix Text (F-4268r2_fix)
Configure a cron job or other automated process to rotate the audit logs on a daily basis.