V-253944

Discussion

The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Check Content

1. Verify that the network device is configured to send log data to a redundant central log servers. 
2. Verify the external syslog server is configured. The lowest severity level, "any", is debug and will generate a significant number of messages.

[edit system syslog]
host <external syslog address> {
    any info;
    structured-format; << Only if structured formatting is required, otherwise events are recorded in standard format.
}
time-format year;

If the network device is not configured to send log data to redundant log servers, this is a finding.