The operating system must back up audit records at least every seven days onto a different system or system component than the system or component being audited.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-47941	SOL-11.1-090220	SV-60813r1_rule		Medium

Description
Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on an organizationally defined frequency helps to assure in the event of a catastrophic system failure, the audit records will be retained. This helps to ensure a compromise of the information system being audited does not also result in a compromise of the audit records. This requirement can be met by the operating system continuously sending records to a centralized logging server.

Description

Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on an organizationally defined frequency helps to assure in the event of a catastrophic system failure, the audit records will be retained. This helps to ensure a compromise of the information system being audited does not also result in a compromise of the audit records. This requirement can be met by the operating system continuously sending records to a centralized logging server.

STIG	Date
Solaris 11 SPARC Security Technical Implementation Guide	2015-04-03

Details

Check Text ( C-50377r1_chk )
This check applies to the global zone only. Determine the zone that you a currently securing. # zonename If the command output is "global" this check applies. The operator must back up audit records at least every 7 days. If the operator is unable to provide a documented procedure or the documented procedure is not being followed, then this is a finding.

Fix Text (F-51553r1_fix)
This fix applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this check applies. The operator shall back up audit records at least every seven days.