Vulnerability Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

Check

Verify that AlmaLinux OS 9 audit system offloads audit records onto a different system or media from the system being audited via rsyslog using TCP with the following command:

$ grep @@ /etc/rsyslog.conf /etc/rsyslog.d/*.conf

/etc/rsyslog.d/stig.conf:*.* @@loghost.example.com"

If a remote server is not configured, or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are offloaded to a different system or media.

If there is no evidence that the audit logs are being offloaded to another system or media, this is a finding.

Fix

Configure AlmaLinux OS 9 to offload audit records onto a different system or media from the system being audited via TCP using rsyslog by specifying the remote logging server in "/etc/rsyslog.conf"" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server.

*.* @@[server]:[port]"