Audit logs must be rotated daily.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239638	VROM-SL-001445	SV-239638r662365_rule		Medium

Description
Rotate audit logs daily to preserve audit file system space and to conform to the DISA requirement. If it is not rotated daily and moved to another location, then there is more of a chance for the compromise of audit data by malicious users.

STIG	Date
VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide	2021-07-01

Details

Check Text ( C-42871r662363_chk )
Check for a logrotate entry that rotates audit logs. # ls -l /etc/logrotate.d/audit If it exists, check for the presence of the daily rotate flag: # egrep "daily" /etc/logrotate.d/audit The command should produce a "daily" entry in the logrotate file for the audit daemon. If the daily entry is missing, this is a finding.

Fix Text (F-42830r662364_fix)
Create or edit the "/etc/logrotate.d/audit" file and add the daily entry, such as: /var/log/audit/audit.log { compress dateext rotate 15 daily missingok notifempty create 600 root root sharedscripts postrotate /sbin/service auditd restart 2> /dev/null > /dev/null || true endscript }