The network element must log all messages except debugging and send all log data to a syslog server.

From Infrastructure Router Security Technical Implementation Guide Juniper

Part of The network element must log all messages except debugging.

SV-15477r2_rule The network element must log all messages except debugging and send all log data to a syslog server.

Vulnerability discussion

Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network. Syslog levels 0-6 are the levels required to collect the necessary information to help in the recovery process.

Check content

Review the network element’s configuration to ensure that all messages up to and including severity level 6 (informational) are logged and sent to a syslog server as shown in the following example: [edit system syslog] syslog { host 192.168.1.22 { any info; facility-override local7; } } The table below lists the severity levels and message types for all log data. Severity Level Message Type 0 Emergencies 1 Alerts 2 Critical 3 Errors 4 Warning 5 Notifications 6 Informational 7 Debugging

Fix text

Configure the network device to log all messages except debugging and send all log data to a syslog server.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.