The network device logging function must be configured to reduce the likelihood of audit log record capacity being exceeded.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000083-NDM-000057	SRG-NET-000083-NDM-000057	SRG-NET-000083-NDM-000057_rule		Low

Description
Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured network device. The network device must be configured to allocate enough log record storage capacity that will not become exhausted. Without this capability, the site could lose valuable data needed for investigating security incidents.

Description

Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured network device. The network device must be configured to allocate enough log record storage capacity that will not become exhausted. Without this capability, the site could lose valuable data needed for investigating security incidents.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000083-NDM-000057_chk )
Verify the network device has mechanisms in place to avoid the log record capacity from being exceeded. If the network device does not have mechanisms in place to avoid the log capacity from being exceeded, this is a finding.

Fix Text (F-SRG-NET-000083-NDM-000057_fix)
Configure the network device to employ mechanisms that avoid the likelihood of log record capacity being exceeded.