Log file data must contain required data elements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-13688	WG242 IIS6	SV-28653r1_rule	ECAR-1 ECAR-2 ECAR-3	Medium

Description
The use of log files is a critical component of the operation of the Information Systems (IS) used within the DoD, and they can provide invaluable assistance with regard to damage assessment, causation, and the recovery of both affected components and data. They may be used to monitor accidental or intentional misuse of the (IS) and may be used by law enforcement for criminal prosecutions. The use of log files is a requirement within the DoD.

Description

The use of log files is a critical component of the operation of the Information Systems (IS) used within the DoD, and they can provide invaluable assistance with regard to damage assessment, causation, and the recovery of both affected components and data. They may be used to monitor accidental or intentional misuse of the (IS) and may be used by law enforcement for criminal prosecutions. The use of log files is a requirement within the DoD.

STIG	Date
IIS6 Site	2015-06-01

Details

Check Text ( C-30008r1_chk )
1. Open the IIS Manager > Right click on the website being reviewed > Select Properties > Select the Web Site tab. 2. Ensure Enable logging is selected. 3. Select the Properties button > Select the Advance tab. 4. Under the Extended logging options ensure the following items are checked: Date, Time, Client IP Address, User Name, Method, URI Query, Http Protocol Status and Referrer If the Enable logging checkbox is not selected, this is a finding. If any of the items listed in step 4 are not selected, this is a finding. NOTE: The collection of additional logging information is acceptable.

Check Text ( C-30008r1_chk )

1. Open the IIS Manager > Right click on the website being reviewed > Select Properties > Select the Web Site tab.
2. Ensure Enable logging is selected.
3. Select the Properties button > Select the Advance tab.
4. Under the Extended logging options ensure the following items are checked:

Date, Time, Client IP Address, User Name, Method, URI Query, Http Protocol Status and Referrer

If the Enable logging checkbox is not selected, this is a finding.
If any of the items listed in step 4 are not selected, this is a finding.

NOTE: The collection of additional logging information is acceptable.

Fix Text (F-32673r1_fix)
1. Open the IIS Manager > Right click on the website being reviewed > Select Properties > Select the Web Site tab. 2. Ensure Enable logging is selected. 3. Select the Properties button > Select the Advance tab. 4. Under the Extended logging options check the following: Date, Time, Client IP Address, User Name, Method, URI Query, Http Protocol Status and Referrer 5. Select OK.