The application server must shut down by default upon log failure (unless availability is an overriding concern).

From Application Server Security Requirements Guide

Part of SRG-APP-000109-AS-000068

Associated with: CCI-000140

SV-46477r3_rule The application server must shut down by default upon log failure (unless availability is an overriding concern).

Vulnerability discussion

It is critical that, when a system is at risk of failing to process logs, it detects and takes action to mitigate the failure. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. During a failure, the application server must be configured to shut down unless the application server is part of a high availability system.When availability is an overriding concern, other approved actions in response to a log failure are as follows: (i) If the failure was caused by the lack of log record storage capacity, the application must continue generating log records if possible (automatically restarting the log service if necessary), overwriting the oldest log records in a first-in-first-out manner.(ii) If log records are sent to a centralized collection server and communication with this server is lost or the server fails, the application must queue log records locally until communication is restored or until the log records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local log data with the collection server.

Check content

If the application server is a high availability system, this finding is NA. Review the application server configuration settings to determine if the application server is configured to shut down on a log failure. If the application server is not configured to shut down on a log failure, this is a finding.

Fix text

If the application server is a high availability system, this finding is NA. Configure the application server to shut down on a log failure.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer