STIGs RMF Controls Compare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

Browse STIGs
Search
RMF Controls
Compare Versions

Resources

About
Release Notes
VPAT
DISA STIG Library

STIGs updated 2 hours ago

Powered by Pylon

© 2026 Beacon Cloud Solutions, Inc. All rights reserved.

← AU-3 — Content of Audit Records

CCI-001487

Definition

Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.

Parent Control

AU-3Content of Audit RecordsAudit and Accountability

Linked STIG Checks (143)

V-204651CAT IIAAA Services configuration audit records must identify any individual user or process associated with the event.AAA Services Security Requirements Guide V-279034CAT IIIColdFusion must produce log records containing information to establish what type of events occurred.Adobe ColdFusion Security Technical Implementation Guide V-274017CAT IIAmazon Linux 2023 must have the audit package installed.Amazon Linux 2023 Security Technical Implementation Guide V-274018CAT IIAmazon Linux 2023 must produce audit records containing information to establish what type of events occurred.Amazon Linux 2023 Security Technical Implementation Guide V-274115CAT IIAmazon Linux 2023 must produce audit records containing information to establish the identity of any individual or process associated with the event.Amazon Linux 2023 Security Technical Implementation Guide V-268090CAT IIThe NixOS audit package must be installed.Anduril NixOS Security Technical Implementation Guide V-214232CAT IIThe Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.Apache Server 2.4 UNIX Server Security Technical Implementation Guide V-214311CAT IIThe Apache web server must produce log records containing sufficient information to establish what type of events occurred.Apache Server 2.4 Windows Server Security Technical Implementation Guide V-222938CAT IIAccessLogValve must be configured per each virtual host.Apache Tomcat Application Server 9 Security Technical Implementation Guide V-252464CAT IIThe macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), in order to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.Apple macOS 12 (Monterey) Security Technical Implementation Guide V-257170CAT IIThe macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.Apple macOS 13 (Ventura) Security Technical Implementation Guide V-268454CAT IIThe macOS system must enable security auditing.Apple macOS 15 (Sequoia) Security Technical Implementation Guide V-277062CAT IIThe macOS system must enable security auditing.Apple macOS 26 (Tahoe) Security Technical Implementation Guide V-204933CAT IIThe ALG must generate audit records containing information to establish the identity of any individual or process associated with the event.Application Layer Gateway Security Requirements Guide V-222477CAT IIThe application must generate audit records containing information that establishes the identity of any individual or process associated with the event.Application Security and Development Security Technical Implementation Guide V-204726CAT IIThe application server must generate log records containing information that establishes the identity of any individual or process associated with the event.Application Server Security Requirements Guide V-237323CAT IThe ArcGIS Server must provide audit record generation capability for DoD-defined auditable events within all application components.ArcGIS for Server 10.3 Security Technical Implementation Guide V-255962CAT IIThe Arista network device must be configured to capture all DOD auditable events.Arista MLS EOS 4.X NDM Security Technical Implementation Guide V-237355CAT IIThe CA API Gateway must generate audit records containing information to establish the identity of any individual or process associated with the event.CA API Gateway ALG Security Technical Implementation Guide V-221913CAT IIIThe Central Log Server must generate audit records containing information that establishes the identity of any individual or process associated with the event.Central Log Server Security Requirements Guide V-271939CAT IIThe Cisco ACI must automatically audit account creation.Cisco ACI NDM Security Technical Implementation Guide V-239971CAT IIThe Cisco ASA remote access VPN server must be configured to generate log records containing information that establishes the identity of any individual or process associated with the event.Cisco ASA VPN Security Technical Implementation Guide V-269468CAT IIAlmaLinux OS 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide V-233047CAT IIAll audit records must identify any users associated with the event within the container platform.Container Platform Security Requirements Guide V-233048CAT IIAll audit records must identify any containers associated with the event within the container platform.Container Platform Security Requirements Guide V-233582CAT IIPostgreSQL must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.Crunchy Data PostgreSQL Security Technical Implementation Guide V-261871CAT IIPostgreSQL must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.Crunchy Data Postgres 16 Security Technical Implementation Guide V-255544CAT IIIThe DBN-6300 must generate audit records containing information that establishes the identity of any individual or process associated with the event.DBN-6300 NDM Security Technical Implementation Guide V-206533CAT IIThe DBMS must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.Database Security Requirements Guide V-269774CAT IIThe Dell OS10 Switch must initiate session auditing upon startup.Dell OS10 Switch NDM Security Technical Implementation Guide V-235778CAT IIThe audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide V-235779CAT IIThe host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide V-205166CAT IIThe DNS server implementation must generate audit records containing information that establishes the identity of any individual or process associated with the event.Domain Name System (DNS) Security Requirements Guide V-224136CAT IIThe EDB Postgres Advanced Server must generate audit records for DoD-defined auditable events.EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide V-213575CAT IIThe EDB Postgres Advanced Server must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide V-259960CAT IIThe Enterprise Voice, Video, and Messaging Endpoint must be configured to produce session (call detail) records containing the identity of all users.Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide V-260001CAT IIThe Enterprise Voice, Video, and Messaging Session Manager must produce session (call) records containing the identity of the users and identifiers associated with the session.Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide V-259224CAT IIThe EDB Postgres Advanced Server must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide V-266146CAT IIThe F5 BIG-IP appliance must generate event log records that can be forwarded to the centralized events log.F5 BIG-IP TMOS ALG Security Technical Implementation Guide V-266068CAT IIThe F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.F5 BIG-IP TMOS NDM Security Technical Implementation Guide V-278385CAT IINGINX must provide audit records for DOD-defined auditable events.F5 NGINX Security Technical Implementation Guide V-234178CAT IIThe FortiGate device must generate audit records containing information that establishes the identity of any individual or process associated with the event.Fortinet FortiGate Firewall NDM Security Technical Implementation Guide V-203671CAT IIThe operating system must produce audit records containing information to establish the identity of any individual or process associated with the event.General Purpose Operating System Security Requirements Guide V-217445CAT IIIThe HP FlexFabric Switch must generate audit records containing information that establishes the identity of any individual or process associated with the event.HP FlexFabric Switch NDM Security Technical Implementation Guide V-268245CAT IIThe HYCU virtual appliance must produce audit records containing information to establish when events occurred, where events occurred, the source of the event, the outcome of the event, and identity of any individual or process associated with the event.HYCU Protege Security Technical Implementation Guide V-215238CAT IIAIX must produce audit records containing information to establish the source and the identity of any individual or process associated with an event.IBM AIX 7.x Security Technical Implementation Guide V-256887CAT IIAudit records content must contain valid information to allow for proper incident reporting.IBM Hardware Management Console (HMC) Security Technical Implementation Guide V-255782CAT IIThe MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.IBM MQ Appliance V9.0 AS Security Technical Implementation Guide V-255732CAT IIThe MQ Appliance network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide V-250325CAT IIThe WebSphere Liberty Server must log remote session and security activity.IBM WebSphere Liberty Server Security Technical Implementation Guide V-255823CAT IIThe WebSphere Application Server audit event type filters must be configured.IBM WebSphere Traditional V9.x Security Technical Implementation Guide V-223544CAT IIIBM z/OS Required SMF data record types must be collected.IBM z/OS ACF2 Security Technical Implementation Guide V-223700CAT IIThe IBM RACF REALDSN SETROPTS value must be specified.IBM z/OS RACF Security Technical Implementation Guide V-223998CAT IIIBM z/OS required SMF data record types must be collected.IBM z/OS TSS Security Technical Implementation Guide V-237899CAT IICA VM:Secure product must be installed and operating.IBM zVM Using CA VM:Secure Security Technical Implementation Guide V-258601CAT IIThe ICS must be configured to audit the execution of privileged functions such as accounts additions and changes.Ivanti Connect Secure NDM Security Technical Implementation Guide V-258587CAT IIIThe ICS must be configured to generate log records containing sufficient information about where, when, identity, source, or outcome of the events.Ivanti Connect Secure VPN Security Technical Implementation Guide V-251020CAT IIIThe Sentry must generate audit records containing information to establish the identity of any individual or process associated with the event.Ivanti MobileIron Sentry 9.x ALG Security Technical Implementation Guide V-251020CAT IIIThe Sentry must generate audit records containing information to establish the identity of any individual or process associated with the event.Ivanti Sentry 9.x ALG Security Technical Implementation Guide V-213512CAT IIJBoss ROOT logger must be configured to utilize the appropriate logging level.JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide V-253894CAT IIThe Juniper EX switch must be configured to generate audit records containing information that establishes the identity of any individual or process associated with the event.Juniper EX Series Switches Network Device Management Security Technical Implementation Guide V-242403CAT IIKubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event.Kubernetes Security Technical Implementation Guide V-213817CAT IISQL Server must produce Trace or Audit records containing sufficient information to establish the identity of any user/subject associated with the event.MS SQL Server 2014 Instance Security Technical Implementation Guide V-205469CAT IIThe Mainframe Product must generate audit records containing information to establish the identity of any individual or process associated with the event.Mainframe Product Security Requirements Guide V-218789CAT IIThe IIS 10.0 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.Microsoft IIS 10.0 Server Security Technical Implementation Guide V-218742CAT IIThe IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.Microsoft IIS 10.0 Site Security Technical Implementation Guide V-221160CAT IIMongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide V-252134CAT IIMongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide V-265907CAT IIMongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide V-279334CAT IIMongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide V-202035CAT IIThe network device must generate audit records containing information that establishes the identity of any individual or process associated with the event.Network Device Management Security Requirements Guide V-254169CAT IINutanix AOS must produce audit records containing information to establish the identity of any individual or process associated with the event.Nutanix AOS 5.20.x OS Security Technical Implementation Guide V-279565CAT IINutanix OS must have the audit.x86_64 package installed.Nutanix Acropolis GPOS Security Technical Implementation Guide V-219759CAT IIThe DBMS must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.Oracle Database 11.2g Security Technical Implementation Guide V-220275CAT IIThe DBMS must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.Oracle Database 12c Security Technical Implementation Guide V-221331CAT IIOHS must have a log format defined to produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.Oracle HTTP Server 12.1.3 Security Technical Implementation Guide V-221332CAT IIOHS must have a SSL log format defined to produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.Oracle HTTP Server 12.1.3 Security Technical Implementation Guide V-221333CAT IIOHS must have a log file defined for each site/virtual host to produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.Oracle HTTP Server 12.1.3 Security Technical Implementation Guide V-221764CAT IIThe Oracle Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.Oracle Linux 7 Security Technical Implementation Guide V-248519CAT IIThe OL 8 audit package must be installed.Oracle Linux 8 Security Technical Implementation Guide V-248520CAT IIOL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.Oracle Linux 8 Security Technical Implementation Guide V-271519CAT IIOL 9 must have the audit package installed.Oracle Linux 9 Security Technical Implementation Guide V-271520CAT IIOL 9 audit service must be enabled.Oracle Linux 9 Security Technical Implementation Guide V-271593CAT IIOL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.Oracle Linux 9 Security Technical Implementation Guide V-235949CAT IIOracle WebLogic must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.Oracle WebLogic Server 12c Security Technical Implementation Guide V-253527CAT IIPrisma Cloud Compute Defender must be deployed to containerization nodes that are to be monitored.Palo Alto Networks Prisma Cloud Compute Security Technical Implementation Guide V-214116CAT IIPostgreSQL must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.PostgreSQL 9.x Security Technical Implementation Guide V-273788CAT IIThe RUCKUS ICX device must initiate session auditing upon startup.RUCKUS ICX NDM Security Technical Implementation Guide V-252846CAT IIRancher MCM must allocate audit record storage and generate audit records associated with events, users, and groups.Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide V-254555CAT IIRancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.Rancher Government Solutions RKE2 Security Technical Implementation Guide V-254563CAT IIAll audit records must identify any containers associated with the event within Rancher RKE2.Rancher Government Solutions RKE2 Security Technical Implementation Guide V-280993CAT IIRHEL 10 must have the "audit" package installed.Red Hat Enterprise Linux 10 Security Technical Implementation Guide V-280994CAT IIRHEL 10 must enable the audit service.Red Hat Enterprise Linux 10 Security Technical Implementation Guide V-281110CAT IIRHEL 10 must produce audit records containing information to establish the identity of any individual or process associated with the event.Red Hat Enterprise Linux 10 Security Technical Implementation Guide V-258151CAT IIRHEL 9 audit package must be installed.Red Hat Enterprise Linux 9 Security Technical Implementation Guide V-258152CAT IIRHEL 9 audit service must be enabled.Red Hat Enterprise Linux 9 Security Technical Implementation Guide V-258169CAT IIRHEL 9 must produce audit records containing information to establish the identity of any individual or process associated with the event.Red Hat Enterprise Linux 9 Security Technical Implementation Guide V-257522CAT IIAll audit records must generate the event results within OpenShift.Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide V-275452CAT IThe Riverbed NetIM must enable and configure user audit logging.Riverbed NetIM NDM Security Technical Implementation Guide V-275677CAT IIUbuntu OS must have the "auditd" package installed.Riverbed NetIM OS Security Technical Implementation Guide V-275678CAT IIUbuntu OS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.Riverbed NetIM OS Security Technical Implementation Guide V-256072CAT IThe Riverbed NetProfiler must be configured to automatically generate DOD-required audit records with sufficient information to support incident reporting to a central log server.Riverbed NetProfiler Security Technical Implementation Guide V-206722CAT IIThe SDN controller must be configured to generate audit records containing information that establishes the identity of any individual or process associated with the event.SDN Controller Security Requirements Guide V-261411CAT IISLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide V-217191CAT IISUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.SUSE Linux Enterprise Server 12 Security Technical Implementation Guide V-216246CAT IIThe audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.Solaris 11 SPARC Security Technical Implementation Guide V-216011CAT IIThe audit system must produce records containing sufficient information to establish the identity of any user/subject associated with the event.Solaris 11 X86 Security Technical Implementation Guide V-279177CAT IIThe Edge SWG must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.Symantec Edge SWG ALG Security Technical Implementation Guide V-279255CAT IIThe Edge SWG must produce audit records containing information to establish when (date and time) the events occurred.Symantec Edge SWG NDM Security Technical Implementation Guide V-94255CAT IISymantec ProxySG must generate audit records containing information to establish the identity of any individual or process associated with the event.Symantec ProxySG ALG Security Technical Implementation Guide V-242259CAT IThe TippingPoint SMS must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).Trend Micro TippingPoint NDM Security Technical Implementation Guide V-282530CAT IITOSS 5 must produce audit records containing information to establish the identity of any individual or process associated with the event.Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide V-234333CAT IIThe UEM server must be configured to generate audit records containing information that establishes the identity of any individual or process associated with the event.Unified Endpoint Management Server Security Requirements Guide V-240050CAT IIHAProxy must log the session ID from the request headers.VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide V-240285CAT IIvRA PostgreSQL database log file data must contain required data elements.VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide V-239782CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.VMW vRealize Operations Manager 6.x PostgreSQL Security Technical Implementation Guide V-240488CAT IIThe SLES for vRealize must produce audit records containing information to establish the identity of any individual or process associated with the event.VMware vRealize Automation 7.x SLES Security Technical Implementation Guide V-240767CAT IItc Server HORIZON must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide V-240768CAT IItc Server VCO must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide V-240769CAT IItc Server VCAC must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide V-239581CAT IIThe SLES for vRealize must produce audit records containing information to establish the identity of any individual or process associated with the event.VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide V-241617CAT IItc Server UI must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide V-241618CAT IItc Server CaSa must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide V-241619CAT IItc Server API must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide V-256650CAT IIVAMI must produce log records containing sufficient information to establish what type of events occurred.VMware vSphere 7.0 VAMI Security Technical Implementation Guide V-256677CAT IIESX Agent Manager must record user access in a format that enables monitoring of remote access.VMware vSphere 7.0 vCenter Appliance EAM Security Technical Implementation Guide V-256710CAT IILookup Service must record user access in a format that enables monitoring of remote access.VMware vSphere 7.0 vCenter Appliance Lookup Service Security Technical Implementation Guide V-256615CAT IIPerformance Charts must record user access in a format that enables monitoring of remote access.VMware vSphere 7.0 vCenter Appliance Perfcharts Security Technical Implementation Guide V-256490CAT IIThe Photon operating system must have the auditd service running.VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide V-256592CAT IIVMware Postgres log files must contain required fields.VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide V-256749CAT IIThe Security Token Service must record user access in a format that enables monitoring of remote access.VMware vSphere 7.0 vCenter Appliance STS Security Technical Implementation Guide V-256782CAT IIvSphere UI must record user access in a format that enables monitoring of remote access.VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide V-259006CAT IIThe vCenter ESX Agent Manager service must produce log records containing sufficient information regarding event details.VMware vSphere 8.0 vCenter Appliance ESX Agent Manager (EAM) Security Technical Implementation Guide V-259040CAT IIThe vCenter Lookup service must produce log records containing sufficient information regarding event details.VMware vSphere 8.0 vCenter Appliance Lookup Service Security Technical Implementation Guide V-259140CAT IIThe vCenter VAMI service must produce log records containing sufficient information to establish what type of events occurred.VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide V-259074CAT IIThe vCenter Perfcharts service must produce log records containing sufficient information regarding event details.VMware vSphere 8.0 vCenter Appliance Perfcharts Security Technical Implementation Guide V-258808CAT IIThe Photon operating system must enable the auditd service.VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide V-259171CAT IIThe vCenter PostgreSQL service must produce logs containing sufficient information to establish what type of events occurred.VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide V-258974CAT IIThe vCenter STS service must produce log records containing sufficient information regarding event details.VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) Security Technical Implementation Guide V-259107CAT IIThe vCenter UI service must produce log records containing sufficient information regarding event details.VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide V-207420CAT IIThe VMM must produce audit records containing information to establish the identity of any individual or process associated with the event.Virtual Machine Manager Security Requirements Guide V-207197CAT IIThe VPN Gateway must generate log records containing information that establishes the identity of any individual or process associated with the event.Virtual Private Network (VPN) Security Requirements Guide V-206365CAT IIThe web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.Web Server Security Requirements Guide