← Back to Nutanix Acropolis Application Server Security Technical Implementation Guide

V-279425

CAT II (Medium)

Nutanix Cluster Check (NCC) must be configured to provide alerts to the system administrator (SA) and information system security officer (ISSO), immediately when audit storage reaches 75 percent capacity.

Rule ID

SV-279425r1192580_rule

STIG

Nutanix Acropolis Application Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001855 CCI-001858 CCI-000139

Discussion

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process logs. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. Notification of the storage condition will allow administrators to take actions so that logs are not lost. This requirement can be met by configuring the application server to use a dedicated logging tool that meets this requirement. Satisfies: SRG-APP-000359-AS-000065, SRG-APP-000360-AS-000066, SRG-APP-000108-AS-000067

Check Content

Confirm the NCC "CVM DISK | System Audit Volume Usage" is enabled and an alert is sent when the disk capacity reaches or exceeds 75 percent.

1. Log in to Prism Element.
2. Select "Health dashboard" from the navigation drop-down.
3. Select Actions >> Manage Checks.
4. Scroll to CVM | Disk section, and then select "System Audit Volume Usage".
5. Validate the Alert Policy settings for "Warning and Critical" are set to 75 percent.

Confirm Nutanix AOS is set to send SMTP alerts to the email address(es) for the ISSO and SA, at a minimum.

1. Log in to Prism Element.
2. Select the "Health" dashboard.
3. On the "Actions" tab, review the setting for "Set NCC Frequency".

If NCC alert settings are not configured as required, this is a finding.

Fix Text

Enable the NCC "CVM DISK | System Audit Volume Usage", set the threshold values, and verify an alert is sent when the disk capacity reaches or exceeds 75 percent.

1. Log in to Prism Element.
2. Select "Health" from the navigation drop-down.
3. Select Actions >> Manage Checks.
4. Scroll to :CVM | Disk" section, then select "System Audit Volume Usage".
5. If check is disabled, click to enable the check.
6. Select "Alert Policy", then set the values for "Warning" and "Critical" thresholds to 75 percent and click "Save".

Configure NCC within Prism Element to send an alert and emails for ISSO and SA.

1. On the Actions tab, select "Set NCC Frequency".
2. Enter frequency timeframe.
3. Enter recipient email address(es).