The operating system must use internal system clocks to generate time stamps for audit records.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
RHEL-06-000382-PNF	RHEL-06-000382-PNF	RHEL-06-000382-PNF_rule		Medium

Description
Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Time stamps generated by the information system shall include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.

STIG	Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide	2013-02-05

Details

Check Text ( C-RHEL-06-000382-PNF_chk )
The RHEL6 auditing system supports this requirement and cannot be configured to be out of compliance. Every audit record in RHEL includes a timestamp, the operation attempted, success or failure of the operation, the subject involved (executable/process), the object involved (file/path), and security labels for the subject and object. It also includes the ability to label events with custom key labels. The auditing system centralizes the recording of audit events for the entire system and includes reduction (ausearch), reporting (aureport), and real-time response (audispd) facilities. This is a permanent not a finding.

Check Text ( C-RHEL-06-000382-PNF_chk )

The RHEL6 auditing system supports this requirement and cannot be configured to be out of compliance. Every audit record in RHEL includes a timestamp, the operation attempted, success or failure of the operation, the subject involved (executable/process), the object involved (file/path), and security labels for the subject and object. It also includes the ability to label events with custom key labels. The auditing system centralizes the recording of audit events for the entire system and includes reduction (ausearch), reporting (aureport), and real-time response (audispd) facilities. This is a permanent not a finding.

Fix Text (F-RHEL-06-000382-PNF_fix)
This requirement is a permanent not a finding. No fix is required.