The system syslog service must log informational and more severe SMTP service messages.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-836	GEN004460	SV-45858r1_rule		Medium

Description
If informational and more severe SMTP service messages are not logged, malicious activity on the system may go unnoticed.

STIG	Date
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide	2018-09-19

Details

Check Text ( C-43154r1_chk )
Check the syslog configuration file for mail.crit logging configuration. Procedure: # grep "mail\." /etc/rsyslog.conf If syslog is not configured to log critical sendmail messages ("mail.crit" or "mail.*"), this is a finding.

Fix Text (F-39240r1_fix)
Edit the syslog configuration file and add a configuration line specifying an appropriate destination for "mail.crit" syslogs. For example: mail.* -/var/log/mail;RSYSLOG_TraditionalFileFormat