The network device must be configured to send an alert to designated personnel in the event of an audit processing failure.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000088-NDM-000060	SRG-NET-000088-NDM-000060	SRG-NET-000088-NDM-000060_rule		Low

Description
Auditing of account use and user actions is a critical part of the security architecture. Auditable events must be logged. If the network device becomes unable to write events to the audit log, this is known as an audit processing failure. Audit processing failures include software and hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. It is imperative that the network device is configured to generate an alarm which should notify system administrators of the audit processing failure. Possible audit processing failures include the inability of network device to write to the central audit log.

Description

Auditing of account use and user actions is a critical part of the security architecture. Auditable events must be logged. If the network device becomes unable to write events to the audit log, this is known as an audit processing failure. Audit processing failures include software and hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. It is imperative that the network device is configured to generate an alarm which should notify system administrators of the audit processing failure. Possible audit processing failures include the inability of network device to write to the central audit log.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000088-NDM-000060_chk )
View the list of configured alerts. Verify an alert is sent to designated personnel when the network device is unable to write to the central audit log server. If the network device is not configured to send an alert to designated personnel when an audit processing failure occurs, this is a finding.

Fix Text (F-SRG-NET-000088-NDM-000060_fix)
Configure the network device to send an alert to designated personnel when an audit processing failure is detected.