← Back to VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide

V-256527

CAT II (Medium)

The Photon operating system must configure auditd to keep five rotated log files.

Rule ID

SV-256527r958752_rule

STIG

VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide

Version

V1R4

CCIs

CCI-001849

Discussion

Audit logs are most useful when accessible by date, rather than size. This can be accomplished through a combination of an audit log rotation cron job, setting a reasonable number of logs to keep, and configuring auditd to not rotate the logs on its own. This ensures audit logs are accessible to the information system security officer (ISSO) in the event of a central log processing failure.

Check Content

At the command line, run the following command:

# grep "^num_logs" /etc/audit/auditd.conf

Expected result:

num_logs = 5

If the output of the command does not match the expected result, this is a finding.

Fix Text

Navigate to and open:

/etc/audit/auditd.conf

Add or change the "num_logs" line as follows:

num_logs = 5

At the command line, run the following commands:

# killproc auditd -TERM
# systemctl start auditd