Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Event log sizes do not meet minimum requirements.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-1118 | 5.002 | SV-29488r1_rule | ECRR-1 | Medium |
| Description |
|---|
| Inadequate log size will cause the log to fill up quickly and require frequent clearing by administrative personnel. |
| STIG | Date |
|---|---|
| Windows 2008 Member Server Security Technical Implementation Guide | 2013-03-14 |
Details
| Check Text ( C-16639r1_chk ) |
|---|
| Vista/2008 - If the following registry values don’t exist or are not configured as specified, then this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: Software\Policies\Microsoft\Windows\EventLog\Application Value Name: MaxSize Type: REG_DWORD Value: 32768 Subkey: Software\Policies\Microsoft\Windows\EventLog\Security Value Name: MaxSize Type: REG_DWORD Value: 81920 Subkey: Software\Policies\Microsoft\Windows\EventLog\Setup Value Name: MaxSize Type: REG_DWORD Value: 32768 Subkey: Software\Policies\Microsoft\Windows\EventLog\System Value Name: MaxSize Type: REG_DWORD Value: 32768 Documentable: Yes Documentable Explanation: If the machine is configured to write an event log directly to an audit server, the “Maximum log size” for that log does not have to conform to the requirements above. This should be documented with the IAO. |
| Fix Text (F-16018r1_fix) |
|---|
| Configure the following policy values as listed below: Computer Configuration -> Administrative Templates -> Windows Components -> Event Log Service -> Application -> “Maximum Log Size (KB)” will be set to “Enabled:32768” Security -> “Maximum Log Size (KB)” will be set to “Enabled:81920” Setup -> “Maximum Log Size (KB)” will be set to “Enabled:32768” System -> “Maximum Log Size (KB)” will be set to “Enabled:32768” |