| Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. Permanent not a finding - Auditing cannot be configured/implemented like a typical UNIX system. Auditing is turned on by default, as is logging. Syslog is the best way to ensure all access is logged. Access is limited to privileged roles only. In lockdown mode (required), only the vpxuser proxy has access. Auditing is addressed at the UNIX SRG level. |
