STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
STIGs updated 2 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide

Version

V2R2

Release Date

Sep 21, 2023

SCAP Benchmark ID

VMW_vRealize_Operations_Manager_6-x_SLES_STIG

Total Checks

212

Tags

vmware
CAT I: 6CAT II: 198CAT III: 8

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (212)

V-239441MEDIUMThe SLES for vRealize must provide automated mechanisms for supporting account management functions.V-239442MEDIUMThe SLES for vRealize must automatically remove or disable temporary user accounts after 72 hours.V-239443MEDIUMThe SLES for vRealize must audit all account creations.V-239444MEDIUMIn addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications, any unexpected users, groups, or modifications must be investigated for legitimacy.V-239445MEDIUMThe SLES for vRealize must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.V-239446MEDIUMThe SLES for vRealize must display the Standard Mandatory DoD Notice and Consent Banner before granting access via SSH.V-239447LOWThe SLES for vRealize must limit the number of concurrent sessions to ten for all accounts and/or account types.V-239448MEDIUMThe SLES for vRealize must initiate a session lock after a 15-minute period of inactivity for all connection types.V-239449MEDIUMThe SLES for vRealize must initiate a session lock after a 15-minute period of inactivity for an SSH connection.V-239450MEDIUMThe SLES for vRealize must monitor remote access methods - SSH Daemon.V-239451MEDIUMThe SLES for vRealize must implement DoD-approved encryption to protect the confidentiality of remote access sessions - SSH Daemon.V-239452MEDIUMThe SLES for vRealize must implement DoD-approved encryption to protect the confidentiality of remote access sessions - SSH Client.V-239453MEDIUMThe SLES for vRealize must produce audit records.V-239454MEDIUMThe SLES for vRealize must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.V-239455MEDIUMThe SLES for vRealize must shut down by default upon audit failure (unless availability is an overriding concern).V-239456MEDIUMThe SLES for vRealize must protect audit information from unauthorized read access - ownership.V-239457MEDIUMThe SLES for vRealize must protect audit information from unauthorized read access - group ownership.V-239458MEDIUMThe SLES for vRealize must protect audit information from unauthorized modification.V-239459MEDIUMThe SLES for vRealize must protect audit information from unauthorized deletion.V-239460MEDIUMThe SLES for vRealize must protect audit information from unauthorized deletion - log directories.V-239474MEDIUMThe SLES for vRealize must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - Permissions.V-239475MEDIUMThe SLES for vRealize must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - ownership.V-239476MEDIUMThe SLES for vRealize must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - group ownership.V-239477MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The operating system must generate audit records for all discretionary access control permission modifications using chmod.V-239478MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using chown.V-239479MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fchmod.V-239480MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fchmodat.V-239481MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fchown.V-239482MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fchownat.V-239483MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fremovexattr.V-239484MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fsetxattr.V-239485MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using lchown.V-239486MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using lremovexattr.V-239487MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using lsetxattr.V-239488MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using removexattr.V-239489MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using setxattr.V-239490MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all failed attempts to access files and programs.V-239491MEDIUMThe SLES for vRealize must enforce password complexity by requiring that at least one upper-case character be used.V-239492MEDIUMGlobal settings defined in common- {account,auth,password,session} must be applied in the pam.d definition files.V-239493MEDIUMThe SLES for vRealize must enforce password complexity by requiring that at least one lower-case character be used.V-239494MEDIUMThe SLES for vRealize must enforce password complexity by requiring that at least one numeric character be used.V-239495MEDIUMThe SLES for vRealize must require the change of at least eight of the total number of characters when passwords are changed.V-239496HIGHThe SLES for vRealize must store only encrypted representations of passwords.V-239497MEDIUMSLES for vRealize must enforce 24 hours/1 day as the minimum password lifetime.V-239498MEDIUMUsers must not be able to change passwords more than once every 24 hours.V-239499MEDIUMSLES for vRealize must enforce a 60-day maximum password lifetime restriction.V-239500MEDIUMUser passwords must be changed at least every 60 days.V-239501MEDIUMThe SLES for vRealize must prohibit password reuse for a minimum of five generations.V-239502MEDIUMThe SLES for vRealize must prohibit password reuse for a minimum of five generations. Ensure the old passwords are being stored.V-239503MEDIUMThe SLES for vRealize must enforce a minimum 15-character password length.V-239504MEDIUMThe SLES for vRealize must require root password authentication upon booting into single-user mode.V-239505MEDIUMBootloader authentication must be enabled to prevent users without privilege to gain access restricted file system resources.V-239506MEDIUMThe SLES for the vRealize boot loader configuration file(s) must have mode 0600 or less permissive.V-239507MEDIUMThe SLES for the vRealize boot loader configuration files must be owned by root.V-239508MEDIUMThe SLES for the vRealize boot loader configuration file(s) must be group-owned by root, bin, sys, or system.V-239509MEDIUMThe Bluetooth protocol handler must be disabled or not installed.V-239510MEDIUMThe SLES for vRealize must have USB Mass Storage disabled unless needed.V-239511MEDIUMThe SLES for vRealize must have USB disabled unless needed.V-239512MEDIUMThe telnet-server package must not be installed.V-239513MEDIUMThe rsh-server package must not be installed.V-239514MEDIUMThe ypserv package must not be installed.V-239515MEDIUMThe yast2-tftp-server package must not be installed.V-239516MEDIUMThe Datagram Congestion Control Protocol (DCCP) must be disabled unless required.V-239517MEDIUMThe Stream Control Transmission Protocol (SCTP) must be disabled unless required.V-239518MEDIUMThe Reliable Datagram Sockets (RDS) protocol must be disabled or not installed unless required.V-239519MEDIUMThe Transparent Inter-Process Communication (TIPC) must be disabled or not installed.V-239520MEDIUMThe xinetd service must be disabled if no network services utilizing it are enabled.V-239521MEDIUMThe ypbind service must not be running if no network services utilizing it are enabled.V-239522MEDIUMNIS/NIS+/yp files must be owned by root, sys, or bin.V-239523MEDIUMThe NIS/NIS+/yp command files must have mode 0755 or less permissive.V-239524MEDIUMThe SLES for vRealize must not use UDP for NIS/NIS+.V-239525MEDIUMNIS maps must be protected through hard-to-guess domain names.V-239526MEDIUMMail relaying must be restricted.V-239527MEDIUMThe alias files must be owned by root.V-239528MEDIUMThe alias files must be group-owned by root, or a system group.V-239529MEDIUMThe alias files must have mode 0644 or less permissive.V-239530MEDIUMFiles executed through a mail aliases file must be owned by root and must reside within a directory owned and writable only by root.V-239531MEDIUMFiles executed through a mail aliases file must be group-owned by root, bin, sys, or system, and must reside within a directory group-owned by root, bin, sys, or system.V-239532MEDIUMFiles executed through a mail aliases file must have mode 0755 or less permissive.V-239533MEDIUMSendmail logging must not be set to less than nine in the sendmail.cf file.V-239534MEDIUMThe system syslog service must log informational and more severe SMTP service messages.V-239535MEDIUMThe SMTP service log files must be owned by root.V-239536MEDIUMThe SMTP service log file must have mode 0644 or less permissive.V-239537MEDIUMThe SMTP service HELP command must not be enabled.V-239538MEDIUMThe SMTP services SMTP greeting must not provide version information.V-239539MEDIUMThe SMTP service must not use .forward files.V-239540MEDIUMThe SMTP service must not have the EXPN feature active.V-239541MEDIUMThe SMTP service must not have the VRFY feature active.V-239542MEDIUMThe Lightweight User Datagram Protocol (UDP-Lite) must be disabled unless required.V-239543MEDIUMThe Internetwork Packet Exchange (IPX) protocol must be disabled or not installed.V-239544MEDIUMThe AppleTalk protocol must be disabled or not installed.V-239545MEDIUMThe DECnet protocol must be disabled or not installed.V-239546MEDIUMProxy Neighbor Discovery Protocol (NDP) must not be enabled on SLES for vRealize.V-239547MEDIUMThe SLES for vRealize must not have 6to4 enabled.V-239548MEDIUMThe SLES for vRealize must not have Teredo enabled.V-239549MEDIUMThe DHCP client must be disabled if not needed.V-239550MEDIUMThe SLES for vRealize must have IEEE 1394 (Firewire) disabled unless needed.V-239551MEDIUMDuplicate User IDs (UIDs) must not exist for users within the organization.V-239552HIGHThe SLES for vRealize must prevent direct logon into the root account.V-239553MEDIUMThe SLES for vRealize must enforce SSHv2 for network access to privileged accounts.V-239554MEDIUMThe SLES for vRealize must enforce SSHv2 for network access to non-privileged accounts.V-239555MEDIUMThe SLES for vRealize must disable account identifiers of individuals and roles (such as root) after 35 days of inactivity after password expiration.V-239556MEDIUMThe SLES for vRealize must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.V-239557MEDIUMThe SLES for vRealize must uniquely identify and must authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-239558MEDIUMThe SLES for vRealize must uniquely identify and must authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-239559MEDIUMThe SLES for vRealize must be configured such that emergency administrator accounts are never automatically removed or disabled.V-239560MEDIUMThe SLES for vRealize must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.V-239561MEDIUMThe SLES for vRealize must terminate all sessions and network connections related to nonlocal maintenance when nonlocal maintenance is completed.V-239562MEDIUMThe SLES for vRealize must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks.V-239563MEDIUMThe SLES for vRealize must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks.V-239564MEDIUMThe SLES for vRealize must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity, except to fulfill documented and validated mission requirements.V-239565MEDIUMThe /var/log directory must be group-owned by root.V-239566MEDIUMThe /var/log directory must be owned by root.V-239567MEDIUMThe /var/log directory must have mode 0750 or less permissive.V-239568MEDIUMThe /var/log/messages file must be group-owned by root.V-239569MEDIUMThe /var/log/messages file must be owned by root.V-239570MEDIUMThe /var/log/messages file must have mode 0640 or less permissive.V-239571MEDIUMThe SLES for vRealize must reveal error messages only to authorized users.V-239572MEDIUMThe SLES for vRealize must reveal error messages only to authorized users.V-239573MEDIUMThe SLES for vRealize must reveal error messages only to authorized users.V-239575MEDIUMThe SLES for vRealize must audit all account modifications.V-239576MEDIUMThe SLES for vRealize must audit all account modifications.V-239577MEDIUMThe SLES for vRealize must audit all account-disabling actions.V-239578MEDIUMThe SLES for vRealize must audit all account removal actions.V-239579MEDIUMThe SLES for vRealize must implement cryptography to protect the integrity of remote access sessions.V-239580MEDIUMThe SLES for vRealize must initiate session audits at system start-up.V-239581MEDIUMThe SLES for vRealize must produce audit records containing information to establish the identity of any individual or process associated with the event.V-239582MEDIUMThe SLES for vRealize must protect audit tools from unauthorized access.V-239583MEDIUMThe SLES for vRealize must protect audit tools from unauthorized modification.V-239584MEDIUMThe SLES for vRealize must protect audit tools from unauthorized deletion.V-239585MEDIUMThe SLES for vRealize must enforce password complexity by requiring that at least one special character be used.V-239586LOWThe SLES for vRealize must notify System Administrators and Information Systems Security Officer when accounts are created.V-239587LOWThe SLES for vRealize must notify System Administrators and Information System Security Officers when accounts are modified.V-239588LOWThe SLES for vRealize must notify System Administrators and Information System Security Officers when accounts are disabled.V-239589LOWThe SLES for vRealize must notify System Administrators and Information System Security Officers when accounts are removed.V-239590MEDIUMThe SLES for vRealize must use cryptographic mechanisms to protect the integrity of audit tools.V-239591MEDIUMThe SLES for vRealize must automatically terminate a user session after inactivity time-outs have expired or at shutdown.V-239592MEDIUMThe SLES for vRealize must control remote access methods.V-239593MEDIUMThe SLES for vRealize must audit all account enabling actions.V-239594MEDIUMThe SLES for vRealize must notify System Administrators and Information System Security Officers when accounts are created, or enabled when previously disabled.V-239595LOWThe SLES for vRealize must audit the execution of privileged functions.V-239596LOWThe SLES for vRealize must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes occur.V-239597LOWThe SLES for vRealize must off-load audit records onto a different system or media from the system being audited.V-239598MEDIUMThe SLES for vRealize must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity.V-239599MEDIUMThe SLES for vRealize must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events requiring real-time alerts.V-239600MEDIUMThe SLES for vRealize must, for networked systems, compare internal information system clocks at least every 24 hours with a server which is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).V-239601MEDIUMThe time synchronization configuration file (such as /etc/ntp.conf) must be owned by root.V-239602MEDIUMThe time synchronization configuration file (such as /etc/ntp.conf) must be group-owned by root, bin, sys, or system.V-239603MEDIUMThe time synchronization configuration file (such as /etc/ntp.conf) must have mode 0640 or less permissive.V-239604MEDIUMThe SLES for vRealize must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.V-239605MEDIUMThe SLES for vRealize must notify designated personnel if baseline configurations are changed in an unauthorized manner.V-239606MEDIUMThe SLES for vRealize must audit the enforcement actions used to restrict access associated with changes to the system.V-239607MEDIUMThe RPM package management tool must cryptographically verify the authenticity of all software packages during installation.V-239608MEDIUMThe SLES for vRealize must audit all activities performed during nonlocal maintenance and diagnostic sessions.V-239609MEDIUMThe SLES for vRealize must implement cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions.V-239610MEDIUMThe SLES for vRealize must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions.V-239611HIGHThe SLES for vRealize must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.V-239612HIGHThe SLES for vRealize must protect the confidentiality and integrity of transmitted information.V-239613HIGHThe SLES for vRealize must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).V-239614MEDIUMThe SLES for vRealize must implement non-executable data to protect its memory from unauthorized code execution.V-239615MEDIUMThe SLES for vRealize must implement address space layout randomization to protect its memory from unauthorized code execution.V-239616MEDIUMThe SLES for vRealize must shut down the information system, restart the information system, and/or notify the system administrator when anomalies in the operation of any security functions are discovered.V-239617MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access security objects occur.V-239618MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.V-239619MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to modify privileges occur.V-239620MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to modify security objects occur.V-239621MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.V-239622MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to delete privileges occur.V-239623MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to delete security levels occur.V-239624MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful attempts to delete security objects occur.V-239625MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful logon attempts occur.V-239626MEDIUMThe SLES for vRealize must generate audit records for privileged activities or other system-level access.V-239627MEDIUMThe SLES for vRealize audit system must be configured to audit the loading and unloading of dynamic kernel modules.V-239628MEDIUMThe SLES for vRealize must generate audit records showing starting and ending time for user access to the system.V-239629MEDIUMThe SLES for vRealize must generate audit records when concurrent logons to the same account occur from different sources.V-239630MEDIUMThe SLES for vRealize must generate audit records when successful/unsuccessful accesses to objects occur.V-239631MEDIUMThe SLES for vRealize audit system must be configured to audit failed attempts to access files and programs.V-239632MEDIUMThe SLES for vRealize audit system must be configured to audit failed attempts to access files and programs.V-239633MEDIUMThe SLES for vRealize audit system must be configured to audit failed attempts to access files and programs.V-239634MEDIUMThe SLES for vRealize audit system must be configured to audit failed attempts to access files and programs.V-239635MEDIUMThe SLES for vRealize audit system must be configured to audit failed attempts to access files and programs.V-239636MEDIUMThe SLES for vRealize audit system must be configured to audit user deletions of files and programs.V-239637MEDIUMThe SLES for vRealize audit system must be configured to audit file deletions.V-239638MEDIUMAudit logs must be rotated daily.V-239639MEDIUMThe SLES for vRealize must generate audit records for all direct access to the information system.V-239640MEDIUMThe SLES for vRealize must generate audit records for all account creations, modifications, disabling, and termination events.V-239641MEDIUMThe SLES for vRealize must generate audit records for all kernel module load, unload, and restart actions, and also for all program initiations.V-239642MEDIUMThe SLES for vRealize must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.V-239643MEDIUMThe SLES for vRealize must, at a minimum, off-load interconnected systems in real time and off-load standalone systems weekly.V-239644MEDIUMThe SLES for vRealize must prevent the use of dictionary words for passwords.V-239645MEDIUMThe SLES for vRealize must prevent the use of dictionary words for passwords.V-239646MEDIUMThe SLES for vRealize must prevent the use of dictionary words for passwords.V-239647MEDIUMThe SLES for vRealize must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt.V-239648MEDIUMThe SLES for vRealize must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt.V-239649MEDIUMThe SLES for vRealize must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt.V-239650MEDIUMThe SLES for vRealize must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.V-239651MEDIUMThe SLES for vRealize must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.V-258448HIGHThe version of vRealize Operations Manager 6.x SLES running on the system must be a supported version.V-258512MEDIUMAny publicly accessible connection to the SLES for vRealize must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.V-258513MEDIUMThe SLES for vRealize audit system must be configured to audit all administrative, privileged, and security actions.V-258514MEDIUMThe SLES for vRealize audit system must be configured to audit all attempts to alter system time through adjtimex.V-258515MEDIUMThe SLES for vRealize audit system must be configured to audit all attempts to alter system time through settimeofday.V-258516MEDIUMThe SLES for vRealize audit system must be configured to audit all attempts to alter system time through stime.V-258517MEDIUMThe SLES for vRealize audit system must be configured to audit all attempts to alter system time through clock_settime.V-258518MEDIUMThe SLES for vRealize audit system must be configured to audit all attempts to alter system time through /etc/localtime.V-258519MEDIUMThe SLES for vRealize audit system must be configured to audit all attempts to alter the system through sethostname.V-258520MEDIUMThe SLES for vRealize audit system must be configured to audit all attempts to alter the system through setdomainname.V-258521MEDIUMThe SLES for vRealize must be configured to audit all attempts to alter the system through sched_setparam.V-258522MEDIUMThe SLES for vRealize must be configured to audit all attempts to alter the system through sched_setscheduler.V-258523MEDIUMThe SLES for vRealize must be configured to audit all attempts to alter /var/log/faillog.V-258524MEDIUMThe SLES for vRealize must be configured to audit all attempts to alter /var/log/lastlog.V-258525MEDIUMThe SLES for vRealize must be configured to audit all attempts to alter /var/log/tallylog.