The Photon operating system must be configured to offload audit logs to a syslog server.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Photon operating system must be configured to offload audit logs to a syslog server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239072	PHTN-67-000129	SV-239072r717090_rule		Medium

Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000447-GPOS-00201

STIG	Date
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide	2021-04-15

Details

Check Text ( C-42283r675022_chk )
At the command prompt, execute the following command: # grep -v "^#" /etc/vmware-syslog/stig-services-auditd.conf Expected result: input(type="imfile" File="/var/log/audit/audit.log" Tag="auditd" Severity="info" Facility="local0") If the file does not exist, this is a finding. If the output of the command does not match the expected result above, this is a finding.

Fix Text (F-42242r675023_fix)
Open /etc/vmware-syslog/vmware-syslog/stig-services-auditd.conf with a text editor. Create the file if it does not exist. Set the contents of the file as follows: input(type="imfile" File="/var/log/audit/audit.log" Tag="auditd" Severity="info" Facility="local0")