The Central Log Server that aggregates log records from hosts and devices must be configured to use TCP for transmission to guarantee delivery.

From Central Log Server Security Requirements Guide

Associated with: CCI-000366

SRG-APP-000516-AU-000340_rule The Central Log Server that aggregates log records from hosts and devices must be configured to use TCP for transmission to guarantee delivery.

Vulnerability discussion

If the default UDP protocol is used for communication between the hosts and devices to the Central Log Server, then log records that do not reach the log server are not detected as a data loss. The use of TCP to transport log records to the log servers guarantees delivery and gives the option to encrypt the traffic if the log server communication is not protected using a management network (preferred) or VPN based on mission requirements.

Check content

Examine the configuration. Verify the Central Log Server is configured to use TCP to guarantee delivery. If the Central Log Server is not configured to use TCP to guarantee delivery, this is a finding.

Fix text

Configure the Central Log Server that aggregates log records from hosts and devices to use TCP for transmission to guarantee delivery.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.