The Syslog daemon is not started at z/OS initialization.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3242	ISLG0010	SV-3242r2_rule	DCCS-1 DCCS-2	Medium

Description
The Syslog daemon, known as SYSLOGD, is a z/OS UNIX daemon that provides a central processing point for log messages issued by other z/OS UNIX processes. The messages may be of varying importance levels including general process information, diagnostic information, critical error notification, and audit-class information. It is important that SYSLOGD be started during the initialization phase of the z/OS system to ensure that significant messages are not lost. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities.

Description

The Syslog daemon, known as SYSLOGD, is a z/OS UNIX daemon that provides a central processing point for log messages issued by other z/OS UNIX processes. The messages may be of varying importance levels including general process information, diagnostic information, critical error notification, and audit-class information. It is important that SYSLOGD be started during the initialization phase of the z/OS system to ensure that significant messages are not lost. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities.

STIG	Date
z/OS RACF STIG	2018-01-05

Details

Check Text ( C-3115r1_chk )
a) Refer to the following report produced by the UNIX System Services Data Collection: - USSCMDS.RPT(ERC) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(PARMLIB) NOTE: SYSLOGD may be started from the shell, a cataloged procedure (STC), or the BPXBATCH program. Additionally, other mechanisms (e.g., CONTROL-O) may be used to automatically start the Syslog daemon. To thoroughly analyze this PDI you may need to view the OS SYSLOG using SDSF, find the last IPL, and look for the initialization of SYSLOGD. b) If the Syslog daemon SYSLOGD is started automatically during the initialization of the z/S/ system, there is NO FINDING. c) If (b) is untrue, this is a FINDING.

Check Text ( C-3115r1_chk )

a) Refer to the following report produced by the UNIX System Services Data Collection:

- USSCMDS.RPT(ERC)

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(PARMLIB)

NOTE: SYSLOGD may be started from the shell, a cataloged procedure (STC), or the BPXBATCH program. Additionally, other mechanisms (e.g., CONTROL-O) may be used to automatically start the Syslog daemon. To thoroughly analyze this PDI you may need to view the OS SYSLOG using SDSF, find the last IPL, and look for the initialization of SYSLOGD.

b) If the Syslog daemon SYSLOGD is started automatically during the initialization of the z/S/ system, there is NO FINDING.

c) If (b) is untrue, this is a FINDING.

Fix Text (F-18171r1_fix)
Review the files used to initialize tasks during system IPL (e.g., /etc/rc, SYS1.PARMLIB, CONTROL-O definitions) to ensure the Syslog daemon is automatically started during z/OS system initialization. It is important that syslogd be started during the initialization phase of the z/OS system to ensure that significant messages are not lost. As with other z/OS UNIX daemons, there is more than one way to start SYSLOGD. It can be started as a process in the /etc/rc file or as a z/OS started task.

Fix Text (F-18171r1_fix)

Review the files used to initialize tasks during system IPL (e.g., /etc/rc, SYS1.PARMLIB, CONTROL-O definitions) to ensure the Syslog daemon is automatically started during z/OS system initialization.

It is important that syslogd be started during the initialization phase of the z/OS system to ensure that significant messages are not lost. As with other z/OS UNIX daemons, there is more than one way to start SYSLOGD. It can be started as a process in the /etc/rc file or as a z/OS started task.