| Auditing of account use and user actions is a critical part of the security architecture. Auditable events must be logged. If the network device becomes unable to write events to the audit log, this is known as an audit processing failure. Audit processing failures include software and hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.
The central audit server configuration must provide methods for preventing audit processing failures, such as traffic congestion and threshold management mechanisms. If the network device is compromised, the attack could involve sending a large volume of audit event messages in an attempt to overwhelm the audit server or other network devices. If this happens, the log server must be configured to detect excessive traffic volume from the network or the network device itself and take action.
This configuration is performed on the central audit logging server and is not applicable to network device management. |
