| Auditing of account use and user actions is a critical part of the security architecture. Auditable events must be logged. If the network element becomes unable to write events to the audit log, this is known as an audit processing failure. Audit processing failures include software and hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
The central audit server configuration must provide methods for preventing audit processing failures, such as traffic congestion and threshold management mechanisms. If the network element is compromised, the attack could involve sending a large volume of audit event messages in an attempt to overwhelm the audit server or other network elements. If this happens, the log server must be configured to detect excessive traffic volume from the network or the network element itself and take action.
This configuration is performed on the central audit logging server and is not applicable to the IDPS. |
