The SETROPTS LOGOPTIONS must be properly configured.

SV-85827r1_rule The SETROPTS LOGOPTIONS must be properly configured.

Vulnerability discussion

Audit records are central to after-the-fact investigations of security incidents. Every effort should be taken to collect as much information as productively feasible for these investigative processes. The SETROPTS LOGOPTIONS option serves as a default auditing requirement. Auditing ‘Failures’ as a minimum will assure a base level of information is available for investigations.

Check content

From the ISPF Command Shell enter: SETRopts List Alternately: Refer to the following report produced by the RACF Data Collection: RACFCMDS.RPT(SETROPTS) Automated Analysis Refer to the following report produced by the RACF Data Collection: PDI(RACF0540) If the following options are specified at a minimum, this is not a finding. LOGOPTIONS "FAILURES" CLASSES = LOGOPTIONS "NEVER" CLASSES = NONE

Fix text

Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below: Ensure that the following LOGOPTIONS are specified: LOGOPTIONS "FAILURES" CLASSES = LOGOPTIONS "NEVER" CLASSES = NONE The other LOGOPTIONS may be site determined.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.