The operating system must back up audit records at least every seven days onto a different system or system component than the system or component being audited.

From Solaris 11 X86 Security Technical Implementation Guide

Associated with: CCI-001348

SV-60813r1_rule The operating system must back up audit records at least every seven days onto a different system or system component than the system or component being audited.

Vulnerability discussion

Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on an organizationally defined frequency helps to assure in the event of a catastrophic system failure, the audit records will be retained.This helps to ensure a compromise of the information system being audited does not also result in a compromise of the audit records.This requirement can be met by the operating system continuously sending records to a centralized logging server.

Check content

This check applies to the global zone only. Determine the zone that you a currently securing. # zonename If the command output is "global" this check applies. The operator must back up audit records at least every 7 days. If the operator is unable to provide a documented procedure or the documented procedure is not being followed, then this is a finding.

Fix text

This fix applies to the global zone only. Determine the zone that you are currently securing. # zonename If the command output is "global", this check applies. The operator shall back up audit records at least every seven days.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.