The operating system must produce audit records containing sufficient information to establish when (date and time) the events occurred.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
RHEL-06-000375-PNF	RHEL-06-000375-PNF	RHEL-06-000375-PNF_rule		Medium

Description
Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. Without sufficient information establishing where the audit events occurred, investigation into the cause of events is severely hindered.

Description

Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. Without sufficient information establishing where the audit events occurred, investigation into the cause of events is severely hindered.

STIG	Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide	2013-02-05

Details

Check Text ( C-RHEL-06-000375-PNF_chk )
The RHEL6 auditing system supports this requirement and cannot be configured to be out of compliance. Every audit record in RHEL includes a timestamp, the operation attempted, success or failure of the operation, the subject involved (executable/process), the object involved (file/path), and security labels for the subject and object. It also includes the ability to label events with custom key labels. The auditing system centralizes the recording of audit events for the entire system and includes reduction (ausearch), reporting (aureport), and real-time response (audispd) facilities. This is a permanent not a finding.

Check Text ( C-RHEL-06-000375-PNF_chk )

The RHEL6 auditing system supports this requirement and cannot be configured to be out of compliance. Every audit record in RHEL includes a timestamp, the operation attempted, success or failure of the operation, the subject involved (executable/process), the object involved (file/path), and security labels for the subject and object. It also includes the ability to label events with custom key labels. The auditing system centralizes the recording of audit events for the entire system and includes reduction (ausearch), reporting (aureport), and real-time response (audispd) facilities. This is a permanent not a finding.

Fix Text (F-RHEL-06-000375-PNF_fix)
This requirement is a permanent not a finding. No fix is required.