The network element must log all messages except debugging and send all log data to a syslog server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4584	NET1021	SV-15477r2_rule	ECAT-1 ECAT-2 ECSC-1	Low

Description
Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. Syslog levels 0-6 are the levels required to collect the necessary information to help in the recovery process.

STIG	Date
Perimeter Router Security Technical Implementation Guide Juniper	2015-12-18

Details

Check Text ( C-12943r2_chk )
Review the network element’s configuration to ensure that all messages up to and including severity level 6 (informational) are logged and sent to a syslog server as shown in the following example: [edit system syslog] syslog { host 192.168.1.22 { any info; facility-override local7; } } The table below lists the severity levels and message types for all log data. Severity Level Message Type 0 Emergencies 1 Alerts 2 Critical 3 Errors 4 Warning 5 Notifications 6 Informational 7 Debugging

Check Text ( C-12943r2_chk )

Review the network element’s configuration to ensure that all messages up to and including severity level 6 (informational) are logged and sent to a syslog server as shown in the following example:

[edit system syslog]
syslog {
host 192.168.1.22 {
any info;
facility-override local7;
}
}

The table below lists the severity levels and message types for all log data.

Severity
Level Message Type

0 Emergencies
1 Alerts
2 Critical
3 Errors
4 Warning
5 Notifications
6 Informational
7 Debugging

Fix Text (F-4517r6_fix)
Configure the network device to log all messages except debugging and send all log data to a syslog server.