[PATCH v3] M1 Incomplete Guidance - Logging and Auditing

Michael Palmiotto mpalmiotto at tresys.com
Fri May 11 20:28:00 UTC 2012


From: Mike Palmiotto <mpalmiotto at tresys.com>


Signed-off-by: Michael Palmiotto <mpalmiotto at tresys.com>
---
 .../auditd_data_retention_admin_space_left.xml     |   30 ++++++++
 .../checks/auditd_data_retention_mail_acct.xml     |   30 ++++++++
 .../input/checks/auditd_data_retention_max_log.xml |   30 ++++++++
 .../checks/auditd_data_retention_max_log_file.xml  |   30 ++++++++
 .../checks/auditd_data_retention_space_left.xml    |   30 ++++++++
 .../input/checks/logwatch_configured_hostlimit.xml |   29 ++++++++
 .../checks/logwatch_configured_splithosts.xml      |   27 ++++++++
 rhel6/src/input/profiles/common.xml                |   14 ++++
 rhel6/src/input/system/auditing.xml                |   69 +++++++++++++++++++-
 rhel6/src/input/system/logging.xml                 |   71 ++++++++++++++++++++
 10 files changed, 359 insertions(+), 1 deletions(-)
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log.xml
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left.xml
 create mode 100644 rhel6/src/input/checks/logwatch_configured_hostlimit.xml
 create mode 100644 rhel6/src/input/checks/logwatch_configured_splithosts.xml

diff --git a/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml b/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
new file mode 100644
index 0000000..b8948a8
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_admin_space_left" version="1">
+    <metadata>
+      <title>Auditd Admin Space Left Action</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>max_log_file_action line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
+    </metadata>
+   
+    <criteria>
+      
+	<criterion comment=" space left line halt" test_ref="test_auditd_data_retention_admin_space_left_action" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" space left line halt" id="test_auditd_data_retention_admin_space_left_action" version="1">
+    <ind:object object_ref="object_auditd_data_retention_admin_space_left_action" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_auditd_data_retention_admin_space_left_action" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^admin\_space\_left\_action[\s]+\=[\s]+halt\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml b/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
new file mode 100644
index 0000000..5c8c2f6
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_mail_acct" version="1">
+    <metadata>
+      <title>Auditd Mail Acct Action</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>action_mail_acct line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
+    </metadata>
+   
+    <criteria>
+      
+	<criterion comment=" mail acct action root" test_ref="test_auditd_data_retention_mail_acct_action" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" mail acct action root" id="test_auditd_data_retention_mail_acct_action" version="1">
+    <ind:object object_ref="object_auditd_data_retention_mail_acct_action" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_auditd_data_retention_mail_acct_action" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^action\_mail\_acct[\s]+\=[\s]+root\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log.xml b/rhel6/src/input/checks/auditd_data_retention_max_log.xml
new file mode 100644
index 0000000..8ea34a0
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_max_log.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_max_log" version="1">
+    <metadata>
+      <title>Auditd Max Log File Size Set</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>max_log_file line is set in auditd.conf.</description>
+    </metadata>
+   
+    <criteria>
+      
+	<criterion comment="max log size" test_ref="test_auditd_data_retention_max_log_size" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="max log size" id="test_auditd_data_retention_max_log_size" version="1">
+    <ind:object object_ref="object_auditd_data_retention_max_log_size" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_size" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^max\_log\_file[\s]+[\d]\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
new file mode 100644
index 0000000..2668b26
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_max_log_file" version="1">
+    <metadata>
+      <title>Auditd Max Log File Action Set</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>max_log_file_action is set to keep logs.</description>
+    </metadata>
+   
+    <criteria>
+      
+	<criterion comment="max log file action" test_ref="test_auditd_data_retention_max_log_file_size" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="max log file action" id="test_auditd_data_retention_max_log_file_size" version="1">
+    <ind:object object_ref="object_auditd_data_retention_max_log_file_size" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_file_size" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^max\_log\_file\_action[\s]+\=[\s]+keep\_logs\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_space_left.xml b/rhel6/src/input/checks/auditd_data_retention_space_left.xml
new file mode 100644
index 0000000..40d30d7
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_space_left.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_space_left" version="1">
+    <metadata>
+      <title>Auditd Space Left Action</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>space_left_action line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
+    </metadata>
+   
+    <criteria>
+      
+	<criterion comment=" space left action email" test_ref="test_auditd_data_retention_space_left_action" />
+
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment=" space left action email" id="test_auditd_data_retention_space_left_action" version="1">
+    <ind:object object_ref="object_auditd_data_retention_space_left_action" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_auditd_data_retention_space_left_action" version="1">
+    <ind:path> /etc/init.d</ind:path>
+    <ind:filename> squid</ind:filename>
+    <ind:pattern operation="pattern match">^space\_left\_action[\s]+\=[\s]+email\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/logwatch_configured_hostlimit.xml b/rhel6/src/input/checks/logwatch_configured_hostlimit.xml
new file mode 100644
index 0000000..c612205
--- /dev/null
+++ b/rhel6/src/input/checks/logwatch_configured_hostlimit.xml
@@ -0,0 +1,29 @@
+<def-group>
+  <definition class="compliance" id="logwatch_configured_hostlimit" version="1">
+    <metadata>
+      <title>Ensure Logwatch HostLimit Configured</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-4323-2" source="CCE" />
+      <description>Test if HostLimit line in logwatch.conf is set appropriately.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="hostlimit" test_ref="test_logwatch_configured_hostlimit" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="test_logwatch_configured_hostlimit" version="1">
+    <ind:object object_ref="object_logwatch_configured_hostlimit" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_state id="state_logwatch_configured_hostlimit" version="1">
+    <ind:subexpression operation="equals">no</ind:subexpression>
+  </ind:textfilecontent54_state>
+  <ind:textfilecontent54_object id="object_logwatch_configured_hostlimit" version="1">
+    <ind:path>/etc/logwatch/conf</ind:path>
+    <ind:filename>logwatch.conf</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/rhel6/src/input/checks/logwatch_configured_splithosts.xml b/rhel6/src/input/checks/logwatch_configured_splithosts.xml
new file mode 100644
index 0000000..12f8975
--- /dev/null
+++ b/rhel6/src/input/checks/logwatch_configured_splithosts.xml
@@ -0,0 +1,27 @@
+<def-group>
+  <definition class="compliance" id="logwatch_configured_splithosts" version="1">
+    <metadata>
+      <title>Ensure Logwatch SplitHosts Configured</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-4323-2" source="CCE" />
+      <description>Check if splithosts line in logwatch.conf is set appropriately.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion comment="splithosts" test_ref="test_logwatch_configured_on_logserver_splithosts" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="test_logwatch_configured_splithosts" version="1">
+    <ind:object object_ref="object_logwatch_configured_splithosts" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_state id="state_logwatch_configured_splithosts" version="1">
+    <ind:subexpression operation="equals">yes</ind:subexpression>
+  </ind:textfilecontent54_state>
+  <ind:textfilecontent54_object id="object_logwatch_configured_splithosts" version="1">
+    <ind:path>/etc/logwatch/conf</ind:path>
+    <ind:filename>logwatch.conf</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index a628a5a..3323079 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -76,6 +76,7 @@
 <select idref="install_openswan" selected="true"/>
 <select idref="package_rsyslog_installed" selected="true"/>
 <select idref="enable_rsyslog" selected="true"/>
+
 <select idref="userowner_rsyslog_files" selected="true"/>
 <select idref="groupowner_rsyslog_files" selected="true"/>
 <select idref="rsyslog_file_permissions" selected="true"/>
@@ -84,6 +85,18 @@
 <select idref="ensure_logrotate_activated" selected="true"/>
 <select idref="enable_auditd_service" selected="true"/>
 <select idref="enable_auditd_bootloader" selected="true"/>
+
+<select idref="configure_auditd_max_log_size" selected="true"/>
+<select idref="configure_auditd_action_mail_acct" selected="true"/>
+<select idref="configure_auditd_space_left_action" selected="true"/>
+<select idref="configure_auditd_admin_space_left_action" selected="true"/>
+<select idref="configure_auditd_max_log_file_action" selected="true"/>
+
+<select idref="configure_logwatch_hostlimit" selected="true"/>
+<select idref="configure_logwatch_splithosts" selected="true"/>
+
+<select idref="disable_logwatch_for_logserver" selected="true"/>
+
 <select idref="audit_time_rules" selected="true"/>
 <select idref="audit_account_changes" selected="true"/>
 <select idref="audit_network_modifications" selected="true"/>
@@ -95,6 +108,7 @@
 <select idref="audit_privileged_commands" selected="true"/>
 <select idref="audit_media_exports" selected="true"/>
 <select idref="audit_file_deletions" selected="true"/>
+
 <select idref="audit_sysadmin_actions" selected="true"/>
 <select idref="audit_kernel_module_loading" selected="true"/>
 <select idref="audit_config_immutable" selected="true"/>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index 4abcb36..aa6f551 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -95,6 +95,74 @@ process during boot.
 <ref nist="AU-2" disa="1464" />
 </Rule>
 
+<Group id="configure_auditd_data_retention">
+<title> Configure <tt>auditd</tt> Data Retention</title>
+<description>
+By default, <tt>auditd</tt> retains 4 log files of size 5Mb apiece. For a busy system or a system which is thoroughly
+auditing system activity, this is likely to be insuffcient. 
+The log file size needed will depend heavily on what types of events are being audited. First configure auditing
+to log all the events of interest. Then monitor the log size manually for awhile to determine what file size will
+allow you to keep the required data for the correct time period.
+
+Using a dedicated partition for <tt>/var/log/audit</tt> prevents the <tt>auditd</tt> logs from disrupting system functionality if they fill, and, more importantly, prevents other activity in <tt>/var</tt> from filling the partition and stopping the audit trail. (The audit logs are size-limited and therefore unlikely to grow without bound unless configured to do so.)
+Some machines may have requirements that no actions occur which cannot be audited. If this is the case, then
+<tt>auditd</tt> can be configured to halt the machine if it runs out of space.
+<b>Note:</b> Since older logs are rotated, configuring <tt>auditd</tt> this way does not prevent older logs from being rotated away before they can be viewed.
+
+<i>If your system is configured to halt when logging cannot be performed, make sure this can never
+happen under normal circumstances! Ensure that <tt>/var/log/audit</tt> is on its own partition, and
+that this partition is larger than the maximum amount of data <tt>auditd</tt> will retain normally.</i></description>
+
+<Rule id="configure_auditd_max_log_size">
+<title>Configure auditd Max Log Size</title>
+<description>Determine <i>STOREMB</i>, the amount of audit data (in megabytes) which should be retained in each log
+file. Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line:
+<pre>max_log_file = <i>STOREMB</i></pre>
+ </description>
+<oval id="auditd_retention_max_log" />
+</Rule>
+
+<Group id="auditd_logical_volume">
+<title>Configure auditd to Use Logical Volume</title>
+<description>Use a dedicated partition (or logical volume) for log files. It is straightforward to create such a partition
+or logical volume during system installation time. The partition should be larger than the maximum
+space which <tt>auditd</tt> will ever use, which is the maximum size of each log file (<tt>max_log_file</tt>) multiplied
+by the number of log files (<tt>num_logs</tt>). Ensure the partition is mounted on <tt>/var/log/audit</tt>.</description>
+</Group>
+
+<Rule id="configure_auditd_space_left_action">
+<title>Configure auditd space_left Action on Low Disk Space</title>
+<description> If your site requires that the machine be disabled when auditing cannot be performed, configure <tt>auditd</tt> to halt the system when disk space for auditing runs low. Edit <tt>/etc/audit/auditd.conf</tt>, and add or
+correct the following lines:
+<pre>space_left_action = email</pre> </description>
+<oval id="auditd_retention_space_left" />
+</Rule>
+
+<Rule id="configure_auditd_action_mail_acct">
+<title>Configure auditd mail_acct Action on Low Disk Space</title>
+<description> 
+Add or correct the following line in auditd.conf to ensure that the machine is halted when disk space for auditing runs low.
+<pre>action_mail_acct = root</pre> </description>
+<oval id="auditd_retention_mail_acct" />
+</Rule>
+
+<Rule id="configure_auditd_admin_space_left_action">
+<title>Configure auditd admin_space_left Action on Low Disk Space</title>
+<description> Add or correct the following line in auditd.conf to ensure that the machine is halted when disk space for auditing runs low.
+<pre>admin_space_left_action = halt</pre> </description>
+<oval id="auditd_retention_admin_space_left" />
+</Rule>
+
+<Rule id="configure_auditd_max_log_file_action">
+<title>Configure auditd max_log_file Action to Keep Logs</title>
+<description> The default action to take when the logs reach their maximum size is to rotate the log files, discarding the
+oldest one. If it is more important to retain all possible auditing information, even if that opens the possibility
+of running out of space and taking the action defined by <tt>admin_space_left_action</tt>, add or correct the line:
+<pre>max_log_file_action = keep_logs</pre> </description>
+<oval id="auditd_retention_max_log_file" />
+</Rule>
+</Group>
+
 <Group id="auditd_configure_rules">
 <title>Configure <tt>auditd</tt> Rules for Comprehensive Auditing</title>
 <description>The <tt>auditd</tt> program can perform comprehensive
@@ -172,7 +240,6 @@ to capture events that modify account changes:
 <ref nist="AU-2(a)" disa="18,1403,1404,1405"/>
 </Rule>
 
-
 <Rule id="audit_network_modifications">
 <title>Record Events that Modify the System’s Network Environment</title>
 <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/logging.xml
index 839484e..d9b852d 100644
--- a/rhel6/src/input/system/logging.xml
+++ b/rhel6/src/input/system/logging.xml
@@ -54,6 +54,24 @@ logging services.
 <ref nist="AU-2" />
 </Rule>
 
+<Group id="ensure_rsyslog_messages_captured">
+<title> Ensure Important Messages are Captured</title>
+<description>
+Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct whichever of the following lines are appropriate for your
+environment:
+<pre>
+auth.*,user.*                                                           /var/log/messages
+kern.*                                                                  /var/log/kern.log
+daemon.*                                                                /var/log/daemon.log
+syslog.*                                                                /var/log/syslog
+lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.*        /var/log/unused.log
+</pre>
+See the man page <tt>rsyslog.conf(5)</tt> for more information.
+<i>By default,</i> <tt>rsyslog</tt> <i>uses a timestamp format that Logwatch does not understand. If your en-
+vironment uses Logwatch, edit the file <tt>/etc/rsyslog.conf</tt> and add or edit the following line:</i>
+<pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</pre></description>
+</Group>
+
 <Group id="log_file_permissions">
 <title>Confirm Existence and Permissions of System Log Files</title>
 <description>For each log file LOGFILE referenced in
@@ -297,4 +315,57 @@ if the /var/log partition becomes full.</rationale>
 <ref nist="AU-2, AU-9, CM-6" />
 </Rule>
 </Group>
+
+<Group id="configure_logwatch_on_logserver">
+<title> Configure Logwatch on the Central Log Server</title>
+<description> 
+Is this machine the central log server? If so, edit the file <tt>/etc/logwatch/conf/logwatch.conf</tt> as shown below.
+</description>
+
+<Rule id="configure_logwatch_hostlimit">
+<title>Configure Logwatch HostLimit Line</title>
+<description> On a central logserver, you want Logwatch to summarize all syslog entries, including those which did not originate 
+on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to report on all hosts, not just the one on which it 
+is running. 
+<pre> HostLimit = no </pre> </description>
+<ident cce="4323-2" />
+<oval id="logwatch_configured_hostlimit" />
+</Rule>
+
+<Rule id="configure_logwatch_splithosts">
+<title>Configure Logwatch SplitHosts Line</title>
+<description>
+If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname. This makes the report longer but significantly 
+more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that 
+information is almost always necessary
+<pre> SplitHosts = yes </pre> </description>
+<ident cce="4323-2" />
+<oval id="logwatch_configured_splithosts" />
+</Rule>
+
+<!--Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default): 
+<pre># cd /etc/cron.daily 
+# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch 
+</pre>
+free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be 
+that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note 
+that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible, 
+such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to 
+the logserver.</description> -->
+
+</Group> <!-- <Group id="configure_logwatch_on_logserver"> -->
+
+<Rule id="disable_logwatch_for_logserver">
+<title> Disable Logwatch on Clients if a Logserver Exists</title>
+<description> 
+Does your site have a central logserver which has been configured to report on logs received from all systems? 
+If so:
+<pre> 
+# rm /etc/cron.daily/0logwatch 
+</pre>
+If no logserver exists, it will be necessary for each machine to run Logwatch individually. Using a central 
+logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier 
+and less time-intensive for administrators.</description>
+<oval id="logwatch_disabled_for_logserver" />
+</Rule>
 </Group>
-- 
1.7.6.5



More information about the scap-security-guide mailing list