← Back to Arista MLS DCS-7000 Series NDM Security Technical Implementation Guide

V-217374

CAT II (Medium)

The Arista Multilayer Switch must, at a minimum, off-load audit records for interconnected systems in real time.

Rule ID

SV-217374r961860_rule

STIG

Arista MLS DCS-7000 Series NDM Security Technical Implementation Guide

Version

V1R4

CCIs

CCI-001851

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.

Check Content

Check the network device configuration to determine if the device off-loads audit records onto a different system or media than the system being audited. 

If the device does not off-load audit records onto a different system or media, this is a finding.

Review the configuration for the "logging host [a.b.c.d]" statement. Execute a "show logging" to verify logging host status.

Fix Text

Configure the network device to off-load interconnected systems in real time and off-load standalone systems weekly.

Arista EOS logs can be exported to, including by a regular syslog server.

Configuration Example: 

switch(config)#logging host[ a.b.c.d]
switch(config)#logging trap informational