The system must be configured to send audit records to a remote audit server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-24357	GEN002870	SV-38413r1_rule	ECTB-1	Low

Description
Audit records contain evidence that can be used in the investigation of compromised systems. To prevent this evidence from compromise, it must be sent to a separate system continuously. Methods for sending audit records include, but are not limited to, system audit tools used to send logs directly to another host or through the system's syslog service to another host.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2017-12-08

Details

Check Text ( C-36807r2_chk )
The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. The vendor (HP) recommends that a script be written to implement a long term strategy for data storage and pass it to the audomon daemon using the "-X " option. is executed each time audomon switches the audit trail. The means used to implement audit log transfer to a remote system will be site specific and therefore always require a manual review. ASK the SA if audomon is configured per the vendor's (HP) guidance to implement a long term, remote data storage strategy.

Check Text ( C-36807r2_chk )

The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. The vendor (HP) recommends that a script be written to implement a long term strategy for data storage and pass it to the audomon daemon using the "-X " option. is executed each time audomon switches the audit trail. The means used to implement audit log transfer to a remote system will be site specific and therefore always require a manual review.

ASK the SA if audomon is configured per the vendor's (HP) guidance to implement a long term, remote data storage strategy.

Fix Text (F-32184r2_fix)
The audit overflow monitor daemon (audomon) is spawned by /sbin/init.d/auditing as part of the init start-up process. Create a script to implement the vendor-recommended, long term data storage strategy and pass it to the audomon daemon using the "-X " option. The must be executed each time audomon switches the audit trail. A manual review of the script is required.