[PATCH v3] M1 Incomplete Guidance - Logging and Auditing

Jeffrey Blank blank at eclipse.ncsc.mil
Mon May 14 21:53:17 UTC 2012


Thanks for the contribution; the granularity is quite good now.

I'll ACK this, as long as you could also please open a ticket to
document the need to fix a few remaining issues.

These are:
1) the OVAL checks should be referencing the correct file
2) <Value>s should be introduced to permit variables for the Rules where
possible
3) we might not want to have the logwatch Rules in the Profile, as a
best practice.  I like logwatch, but there's a lot of variation in this
space.

One ticket could probably cover this.

Thanks!





On 05/11/2012 04:28 PM, Michael Palmiotto wrote:
> From: Mike Palmiotto <mpalmiotto at tresys.com>
> 
> 
> Signed-off-by: Michael Palmiotto <mpalmiotto at tresys.com>
> ---
>  .../auditd_data_retention_admin_space_left.xml     |   30 ++++++++
>  .../checks/auditd_data_retention_mail_acct.xml     |   30 ++++++++
>  .../input/checks/auditd_data_retention_max_log.xml |   30 ++++++++
>  .../checks/auditd_data_retention_max_log_file.xml  |   30 ++++++++
>  .../checks/auditd_data_retention_space_left.xml    |   30 ++++++++
>  .../input/checks/logwatch_configured_hostlimit.xml |   29 ++++++++
>  .../checks/logwatch_configured_splithosts.xml      |   27 ++++++++
>  rhel6/src/input/profiles/common.xml                |   14 ++++
>  rhel6/src/input/system/auditing.xml                |   69 +++++++++++++++++++-
>  rhel6/src/input/system/logging.xml                 |   71 ++++++++++++++++++++
>  10 files changed, 359 insertions(+), 1 deletions(-)
>  create mode 100644 rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
>  create mode 100644 rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
>  create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log.xml
>  create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
>  create mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left.xml
>  create mode 100644 rhel6/src/input/checks/logwatch_configured_hostlimit.xml
>  create mode 100644 rhel6/src/input/checks/logwatch_configured_splithosts.xml
> 
> diff --git a/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml b/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
> new file mode 100644
> index 0000000..b8948a8
> --- /dev/null
> +++ b/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
> @@ -0,0 +1,30 @@
> +<def-group>
> +  <definition class="compliance" id="auditd_data_retention_admin_space_left" version="1">
> +    <metadata>
> +      <title>Auditd Admin Space Left Action</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="TODO" source="CCE" />
> +      <description>max_log_file_action line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
> +    </metadata>
> +   
> +    <criteria>
> +      
> +	<criterion comment=" space left line halt" test_ref="test_auditd_data_retention_admin_space_left_action" />
> +
> +    </criteria>
> +
> +  </definition>
> +  
> +  <ind:textfilecontent54_test check="all" comment=" space left line halt" id="test_auditd_data_retention_admin_space_left_action" version="1">
> +    <ind:object object_ref="object_auditd_data_retention_admin_space_left_action" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_auditd_data_retention_admin_space_left_action" version="1">
> +    <ind:path> /etc/init.d</ind:path>
> +    <ind:filename> squid</ind:filename>
> +    <ind:pattern operation="pattern match">^admin\_space\_left\_action[\s]+\=[\s]+halt\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +</def-group>
> diff --git a/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml b/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
> new file mode 100644
> index 0000000..5c8c2f6
> --- /dev/null
> +++ b/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
> @@ -0,0 +1,30 @@
> +<def-group>
> +  <definition class="compliance" id="auditd_data_retention_mail_acct" version="1">
> +    <metadata>
> +      <title>Auditd Mail Acct Action</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="TODO" source="CCE" />
> +      <description>action_mail_acct line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
> +    </metadata>
> +   
> +    <criteria>
> +      
> +	<criterion comment=" mail acct action root" test_ref="test_auditd_data_retention_mail_acct_action" />
> +
> +    </criteria>
> +
> +  </definition>
> +  
> +  <ind:textfilecontent54_test check="all" comment=" mail acct action root" id="test_auditd_data_retention_mail_acct_action" version="1">
> +    <ind:object object_ref="object_auditd_data_retention_mail_acct_action" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_auditd_data_retention_mail_acct_action" version="1">
> +    <ind:path> /etc/init.d</ind:path>
> +    <ind:filename> squid</ind:filename>
> +    <ind:pattern operation="pattern match">^action\_mail\_acct[\s]+\=[\s]+root\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +</def-group>
> diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log.xml b/rhel6/src/input/checks/auditd_data_retention_max_log.xml
> new file mode 100644
> index 0000000..8ea34a0
> --- /dev/null
> +++ b/rhel6/src/input/checks/auditd_data_retention_max_log.xml
> @@ -0,0 +1,30 @@
> +<def-group>
> +  <definition class="compliance" id="auditd_data_retention_max_log" version="1">
> +    <metadata>
> +      <title>Auditd Max Log File Size Set</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="TODO" source="CCE" />
> +      <description>max_log_file line is set in auditd.conf.</description>
> +    </metadata>
> +   
> +    <criteria>
> +      
> +	<criterion comment="max log size" test_ref="test_auditd_data_retention_max_log_size" />
> +
> +    </criteria>
> +
> +  </definition>
> +  
> +  <ind:textfilecontent54_test check="all" comment="max log size" id="test_auditd_data_retention_max_log_size" version="1">
> +    <ind:object object_ref="object_auditd_data_retention_max_log_size" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_size" version="1">
> +    <ind:path> /etc/init.d</ind:path>
> +    <ind:filename> squid</ind:filename>
> +    <ind:pattern operation="pattern match">^max\_log\_file[\s]+[\d]\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +</def-group>
> diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
> new file mode 100644
> index 0000000..2668b26
> --- /dev/null
> +++ b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
> @@ -0,0 +1,30 @@
> +<def-group>
> +  <definition class="compliance" id="auditd_data_retention_max_log_file" version="1">
> +    <metadata>
> +      <title>Auditd Max Log File Action Set</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="TODO" source="CCE" />
> +      <description>max_log_file_action is set to keep logs.</description>
> +    </metadata>
> +   
> +    <criteria>
> +      
> +	<criterion comment="max log file action" test_ref="test_auditd_data_retention_max_log_file_size" />
> +
> +    </criteria>
> +
> +  </definition>
> +  
> +  <ind:textfilecontent54_test check="all" comment="max log file action" id="test_auditd_data_retention_max_log_file_size" version="1">
> +    <ind:object object_ref="object_auditd_data_retention_max_log_file_size" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_file_size" version="1">
> +    <ind:path> /etc/init.d</ind:path>
> +    <ind:filename> squid</ind:filename>
> +    <ind:pattern operation="pattern match">^max\_log\_file\_action[\s]+\=[\s]+keep\_logs\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +</def-group>
> diff --git a/rhel6/src/input/checks/auditd_data_retention_space_left.xml b/rhel6/src/input/checks/auditd_data_retention_space_left.xml
> new file mode 100644
> index 0000000..40d30d7
> --- /dev/null
> +++ b/rhel6/src/input/checks/auditd_data_retention_space_left.xml
> @@ -0,0 +1,30 @@
> +<def-group>
> +  <definition class="compliance" id="auditd_data_retention_space_left" version="1">
> +    <metadata>
> +      <title>Auditd Space Left Action</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="TODO" source="CCE" />
> +      <description>space_left_action line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
> +    </metadata>
> +   
> +    <criteria>
> +      
> +	<criterion comment=" space left action email" test_ref="test_auditd_data_retention_space_left_action" />
> +
> +    </criteria>
> +
> +  </definition>
> +  
> +  <ind:textfilecontent54_test check="all" comment=" space left action email" id="test_auditd_data_retention_space_left_action" version="1">
> +    <ind:object object_ref="object_auditd_data_retention_space_left_action" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object id="object_auditd_data_retention_space_left_action" version="1">
> +    <ind:path> /etc/init.d</ind:path>
> +    <ind:filename> squid</ind:filename>
> +    <ind:pattern operation="pattern match">^space\_left\_action[\s]+\=[\s]+email\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +</def-group>
> diff --git a/rhel6/src/input/checks/logwatch_configured_hostlimit.xml b/rhel6/src/input/checks/logwatch_configured_hostlimit.xml
> new file mode 100644
> index 0000000..c612205
> --- /dev/null
> +++ b/rhel6/src/input/checks/logwatch_configured_hostlimit.xml
> @@ -0,0 +1,29 @@
> +<def-group>
> +  <definition class="compliance" id="logwatch_configured_hostlimit" version="1">
> +    <metadata>
> +      <title>Ensure Logwatch HostLimit Configured</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="CCE-4323-2" source="CCE" />
> +      <description>Test if HostLimit line in logwatch.conf is set appropriately.</description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion comment="hostlimit" test_ref="test_logwatch_configured_hostlimit" />
> +    </criteria>
> +  </definition>
> +
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="test_logwatch_configured_hostlimit" version="1">
> +    <ind:object object_ref="object_logwatch_configured_hostlimit" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_state id="state_logwatch_configured_hostlimit" version="1">
> +    <ind:subexpression operation="equals">no</ind:subexpression>
> +  </ind:textfilecontent54_state>
> +  <ind:textfilecontent54_object id="object_logwatch_configured_hostlimit" version="1">
> +    <ind:path>/etc/logwatch/conf</ind:path>
> +    <ind:filename>logwatch.conf</ind:filename>
> +    <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*[\w]+\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +</def-group>
> diff --git a/rhel6/src/input/checks/logwatch_configured_splithosts.xml b/rhel6/src/input/checks/logwatch_configured_splithosts.xml
> new file mode 100644
> index 0000000..12f8975
> --- /dev/null
> +++ b/rhel6/src/input/checks/logwatch_configured_splithosts.xml
> @@ -0,0 +1,27 @@
> +<def-group>
> +  <definition class="compliance" id="logwatch_configured_splithosts" version="1">
> +    <metadata>
> +      <title>Ensure Logwatch SplitHosts Configured</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <reference ref_id="CCE-4323-2" source="CCE" />
> +      <description>Check if splithosts line in logwatch.conf is set appropriately.</description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion comment="splithosts" test_ref="test_logwatch_configured_on_logserver_splithosts" />
> +    </criteria>
> +  </definition>
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="test_logwatch_configured_splithosts" version="1">
> +    <ind:object object_ref="object_logwatch_configured_splithosts" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_state id="state_logwatch_configured_splithosts" version="1">
> +    <ind:subexpression operation="equals">yes</ind:subexpression>
> +  </ind:textfilecontent54_state>
> +  <ind:textfilecontent54_object id="object_logwatch_configured_splithosts" version="1">
> +    <ind:path>/etc/logwatch/conf</ind:path>
> +    <ind:filename>logwatch.conf</ind:filename>
> +    <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*[\w]+\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
> index a628a5a..3323079 100644
> --- a/rhel6/src/input/profiles/common.xml
> +++ b/rhel6/src/input/profiles/common.xml
> @@ -76,6 +76,7 @@
>  <select idref="install_openswan" selected="true"/>
>  <select idref="package_rsyslog_installed" selected="true"/>
>  <select idref="enable_rsyslog" selected="true"/>
> +
>  <select idref="userowner_rsyslog_files" selected="true"/>
>  <select idref="groupowner_rsyslog_files" selected="true"/>
>  <select idref="rsyslog_file_permissions" selected="true"/>
> @@ -84,6 +85,18 @@
>  <select idref="ensure_logrotate_activated" selected="true"/>
>  <select idref="enable_auditd_service" selected="true"/>
>  <select idref="enable_auditd_bootloader" selected="true"/>
> +
> +<select idref="configure_auditd_max_log_size" selected="true"/>
> +<select idref="configure_auditd_action_mail_acct" selected="true"/>
> +<select idref="configure_auditd_space_left_action" selected="true"/>
> +<select idref="configure_auditd_admin_space_left_action" selected="true"/>
> +<select idref="configure_auditd_max_log_file_action" selected="true"/>
> +
> +<select idref="configure_logwatch_hostlimit" selected="true"/>
> +<select idref="configure_logwatch_splithosts" selected="true"/>
> +
> +<select idref="disable_logwatch_for_logserver" selected="true"/>
> +
>  <select idref="audit_time_rules" selected="true"/>
>  <select idref="audit_account_changes" selected="true"/>
>  <select idref="audit_network_modifications" selected="true"/>
> @@ -95,6 +108,7 @@
>  <select idref="audit_privileged_commands" selected="true"/>
>  <select idref="audit_media_exports" selected="true"/>
>  <select idref="audit_file_deletions" selected="true"/>
> +
>  <select idref="audit_sysadmin_actions" selected="true"/>
>  <select idref="audit_kernel_module_loading" selected="true"/>
>  <select idref="audit_config_immutable" selected="true"/>
> diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
> index 4abcb36..aa6f551 100644
> --- a/rhel6/src/input/system/auditing.xml
> +++ b/rhel6/src/input/system/auditing.xml
> @@ -95,6 +95,74 @@ process during boot.
>  <ref nist="AU-2" disa="1464" />
>  </Rule>
>  
> +<Group id="configure_auditd_data_retention">
> +<title> Configure <tt>auditd</tt> Data Retention</title>
> +<description>
> +By default, <tt>auditd</tt> retains 4 log files of size 5Mb apiece. For a busy system or a system which is thoroughly
> +auditing system activity, this is likely to be insuffcient. 
> +The log file size needed will depend heavily on what types of events are being audited. First configure auditing
> +to log all the events of interest. Then monitor the log size manually for awhile to determine what file size will
> +allow you to keep the required data for the correct time period.
> +
> +Using a dedicated partition for <tt>/var/log/audit</tt> prevents the <tt>auditd</tt> logs from disrupting system functionality if they fill, and, more importantly, prevents other activity in <tt>/var</tt> from filling the partition and stopping the audit trail. (The audit logs are size-limited and therefore unlikely to grow without bound unless configured to do so.)
> +Some machines may have requirements that no actions occur which cannot be audited. If this is the case, then
> +<tt>auditd</tt> can be configured to halt the machine if it runs out of space.
> +<b>Note:</b> Since older logs are rotated, configuring <tt>auditd</tt> this way does not prevent older logs from being rotated away before they can be viewed.
> +
> +<i>If your system is configured to halt when logging cannot be performed, make sure this can never
> +happen under normal circumstances! Ensure that <tt>/var/log/audit</tt> is on its own partition, and
> +that this partition is larger than the maximum amount of data <tt>auditd</tt> will retain normally.</i></description>
> +
> +<Rule id="configure_auditd_max_log_size">
> +<title>Configure auditd Max Log Size</title>
> +<description>Determine <i>STOREMB</i>, the amount of audit data (in megabytes) which should be retained in each log
> +file. Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line:
> +<pre>max_log_file = <i>STOREMB</i></pre>
> + </description>
> +<oval id="auditd_retention_max_log" />
> +</Rule>
> +
> +<Group id="auditd_logical_volume">
> +<title>Configure auditd to Use Logical Volume</title>
> +<description>Use a dedicated partition (or logical volume) for log files. It is straightforward to create such a partition
> +or logical volume during system installation time. The partition should be larger than the maximum
> +space which <tt>auditd</tt> will ever use, which is the maximum size of each log file (<tt>max_log_file</tt>) multiplied
> +by the number of log files (<tt>num_logs</tt>). Ensure the partition is mounted on <tt>/var/log/audit</tt>.</description>
> +</Group>
> +
> +<Rule id="configure_auditd_space_left_action">
> +<title>Configure auditd space_left Action on Low Disk Space</title>
> +<description> If your site requires that the machine be disabled when auditing cannot be performed, configure <tt>auditd</tt> to halt the system when disk space for auditing runs low. Edit <tt>/etc/audit/auditd.conf</tt>, and add or
> +correct the following lines:
> +<pre>space_left_action = email</pre> </description>
> +<oval id="auditd_retention_space_left" />
> +</Rule>
> +
> +<Rule id="configure_auditd_action_mail_acct">
> +<title>Configure auditd mail_acct Action on Low Disk Space</title>
> +<description> 
> +Add or correct the following line in auditd.conf to ensure that the machine is halted when disk space for auditing runs low.
> +<pre>action_mail_acct = root</pre> </description>
> +<oval id="auditd_retention_mail_acct" />
> +</Rule>
> +
> +<Rule id="configure_auditd_admin_space_left_action">
> +<title>Configure auditd admin_space_left Action on Low Disk Space</title>
> +<description> Add or correct the following line in auditd.conf to ensure that the machine is halted when disk space for auditing runs low.
> +<pre>admin_space_left_action = halt</pre> </description>
> +<oval id="auditd_retention_admin_space_left" />
> +</Rule>
> +
> +<Rule id="configure_auditd_max_log_file_action">
> +<title>Configure auditd max_log_file Action to Keep Logs</title>
> +<description> The default action to take when the logs reach their maximum size is to rotate the log files, discarding the
> +oldest one. If it is more important to retain all possible auditing information, even if that opens the possibility
> +of running out of space and taking the action defined by <tt>admin_space_left_action</tt>, add or correct the line:
> +<pre>max_log_file_action = keep_logs</pre> </description>
> +<oval id="auditd_retention_max_log_file" />
> +</Rule>
> +</Group>
> +
>  <Group id="auditd_configure_rules">
>  <title>Configure <tt>auditd</tt> Rules for Comprehensive Auditing</title>
>  <description>The <tt>auditd</tt> program can perform comprehensive
> @@ -172,7 +240,6 @@ to capture events that modify account changes:
>  <ref nist="AU-2(a)" disa="18,1403,1404,1405"/>
>  </Rule>
>  
> -
>  <Rule id="audit_network_modifications">
>  <title>Record Events that Modify the System’s Network Environment</title>
>  <description>Add the following to <tt>/etc/audit/audit.rules</tt>, setting
> diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/logging.xml
> index 839484e..d9b852d 100644
> --- a/rhel6/src/input/system/logging.xml
> +++ b/rhel6/src/input/system/logging.xml
> @@ -54,6 +54,24 @@ logging services.
>  <ref nist="AU-2" />
>  </Rule>
>  
> +<Group id="ensure_rsyslog_messages_captured">
> +<title> Ensure Important Messages are Captured</title>
> +<description>
> +Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct whichever of the following lines are appropriate for your
> +environment:
> +<pre>
> +auth.*,user.*                                                           /var/log/messages
> +kern.*                                                                  /var/log/kern.log
> +daemon.*                                                                /var/log/daemon.log
> +syslog.*                                                                /var/log/syslog
> +lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.*        /var/log/unused.log
> +</pre>
> +See the man page <tt>rsyslog.conf(5)</tt> for more information.
> +<i>By default,</i> <tt>rsyslog</tt> <i>uses a timestamp format that Logwatch does not understand. If your en-
> +vironment uses Logwatch, edit the file <tt>/etc/rsyslog.conf</tt> and add or edit the following line:</i>
> +<pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</pre></description>
> +</Group>
> +
>  <Group id="log_file_permissions">
>  <title>Confirm Existence and Permissions of System Log Files</title>
>  <description>For each log file LOGFILE referenced in
> @@ -297,4 +315,57 @@ if the /var/log partition becomes full.</rationale>
>  <ref nist="AU-2, AU-9, CM-6" />
>  </Rule>
>  </Group>
> +
> +<Group id="configure_logwatch_on_logserver">
> +<title> Configure Logwatch on the Central Log Server</title>
> +<description> 
> +Is this machine the central log server? If so, edit the file <tt>/etc/logwatch/conf/logwatch.conf</tt> as shown below.
> +</description>
> +
> +<Rule id="configure_logwatch_hostlimit">
> +<title>Configure Logwatch HostLimit Line</title>
> +<description> On a central logserver, you want Logwatch to summarize all syslog entries, including those which did not originate 
> +on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to report on all hosts, not just the one on which it 
> +is running. 
> +<pre> HostLimit = no </pre> </description>
> +<ident cce="4323-2" />
> +<oval id="logwatch_configured_hostlimit" />
> +</Rule>
> +
> +<Rule id="configure_logwatch_splithosts">
> +<title>Configure Logwatch SplitHosts Line</title>
> +<description>
> +If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname. This makes the report longer but significantly 
> +more usable. If it is not set, then Logwatch will not report which host generated a given log entry, and that 
> +information is almost always necessary
> +<pre> SplitHosts = yes </pre> </description>
> +<ident cce="4323-2" />
> +<oval id="logwatch_configured_splithosts" />
> +</Rule>
> +
> +<!--Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default): 
> +<pre># cd /etc/cron.daily 
> +# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch 
> +</pre>
> +free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be 
> +that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note 
> +that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible, 
> +such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to 
> +the logserver.</description> -->
> +
> +</Group> <!-- <Group id="configure_logwatch_on_logserver"> -->
> +
> +<Rule id="disable_logwatch_for_logserver">
> +<title> Disable Logwatch on Clients if a Logserver Exists</title>
> +<description> 
> +Does your site have a central logserver which has been configured to report on logs received from all systems? 
> +If so:
> +<pre> 
> +# rm /etc/cron.daily/0logwatch 
> +</pre>
> +If no logserver exists, it will be necessary for each machine to run Logwatch individually. Using a central 
> +logserver provides the security and reliability benefits discussed earlier, and also makes monitoring logs easier 
> +and less time-intensive for administrators.</description>
> +<oval id="logwatch_disabled_for_logserver" />
> +</Rule>
>  </Group>


More information about the scap-security-guide mailing list