The operating system must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
RHEL-06-000378-PNF	RHEL-06-000378-PNF	RHEL-06-000378-PNF_rule		Medium

Description
Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. Success and failure indicators ascertain the outcome of a particular event. As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.

Description

Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. Success and failure indicators ascertain the outcome of a particular event. As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.

STIG	Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide	2013-02-05

Details

Check Text ( C-RHEL-06-000378-PNF_chk )
The RHEL6 auditing system supports this requirement and cannot be configured to be out of compliance. Every audit record in RHEL includes a timestamp, the operation attempted, success or failure of the operation, the subject involved (executable/process), the object involved (file/path), and security labels for the subject and object. It also includes the ability to label events with custom key labels. The auditing system centralizes the recording of audit events for the entire system and includes reduction (ausearch), reporting (aureport), and real-time response (audispd) facilities. This is a permanent not a finding.

Check Text ( C-RHEL-06-000378-PNF_chk )

The RHEL6 auditing system supports this requirement and cannot be configured to be out of compliance. Every audit record in RHEL includes a timestamp, the operation attempted, success or failure of the operation, the subject involved (executable/process), the object involved (file/path), and security labels for the subject and object. It also includes the ability to label events with custom key labels. The auditing system centralizes the recording of audit events for the entire system and includes reduction (ausearch), reporting (aureport), and real-time response (audispd) facilities. This is a permanent not a finding.

Fix Text (F-RHEL-06-000378-PNF_fix)
This requirement is a permanent not a finding. No fix is required.