UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Audispd must offload audit records onto a different system or media from SLEM 5 being audited.


Overview

Finding ID Version Rule ID IA Controls Severity
V-261422 SLEM-05-653070 SV-261422r996674_rule Medium
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity.
STIG Date
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide 2024-06-04

Details

Check Text ( C-65151r996673_chk )
Verify "audispd" offloads audit records onto a different system or media from SLEM 5 being audited with the following command:

> sudo grep remote_server /etc/audisp/audisp-remote.conf
remote_server = 240.9.19.81

If "remote_server" is not set to an external server or media, or is commented out, this is a finding.
Fix Text (F-65059r996132_fix)
Configure SLEM 5 to offload audit records onto a different system or media.

Add or modify the following line in the "/etc/audisp/audisp-remote.conf" file:

remote_server =