AU-04(01) Transfer to Alternate Storage
All changes in this version
Title
Transfer to Alternate Storage
Control
Transfer audit logs [Assignment: frequency] to a different system, system component, or media other than the system or system component conducting the logging.
Discussion
Audit log transfer, also known as off-loading, is a common process in systems with limited audit log storage capacity and thus supports availability of the audit logs. The initial audit log storage is only used in a transitory fashion until the system can communicate with the secondary or alternate system allocated to audit log storage, at which point the audit logs are transferred. Transferring audit logs to alternate storage is similar to [AU-9(2)](#au-9.2) in that audit logs are transferred to a different entity. However, the purpose of selecting [AU-9(2)](#au-9.2) is to protect the confidentiality and integrity of audit records. Organizations can select either control enhancement to obtain the benefit of increased audit log storage capacity and preserving the confidentiality, integrity, and availability of audit records and logs.
Parameters
au-04.01_odp: frequency
Assessment objective
AU-04(01) audit logs are transferred [Assignment: frequency] to a different system, system component, or media other than the system or system component conducting the logging.
STIG rules that implement this control 29
Application Security and Development V6R5
- APSC-DV-001070 CAT II The application must off-load audit records onto a different system or media than the system being audited.
- APSC-DV-001080 CAT II The application must be configured to write application logs to a centralized log repository.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-651035 CAT III Ubuntu 22.04 LTS must have a crontab script running weekly to offload audit events of standalone systems.
- UBTU-22-653020 CAT III Ubuntu 22.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system from the system being audited.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100450 CAT III Ubuntu 24.04 LTS audit event multiplexor must be configured to offload audit logs onto a different system or storage media from the system being audited.
- UBTU-24-900950 CAT III Ubuntu 24.04 LTS must have a crontab script running weekly to offload audit events of standalone systems.
Cisco IOS XE Router NDM Y26M04
- CISC-ND-001450 CAT I The Cisco router must be configured to send log data to at least two syslog servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
Microsoft Windows Server 2022 V2R11
- WN22-AU-000010 CAT II Windows Server 2022 audit records must be backed up to a different system or media than the system being audited.
- WN22-AU-000020 CAT II Windows Server 2022 must, at a minimum, offload audit records of interconnected systems in real time and offload standalone or nondomain-joined systems weekly.
Microsoft Windows Server 2025 V1R4
- WN25-AU-000010 CAT II Windows Server 2025 audit records must be backed up to a different system or media than the system being audited.
- WN25-AU-000020 CAT II Windows Server 2025 must, at a minimum, off-load audit records of interconnected systems in real time and off-load stand-alone or nondomain-joined systems weekly.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200640 CAT II RHEL 10 must have the "rsyslog" package installed.
- RHEL-10-200642 CAT II RHEL 10 must be configured to forward audit records via Transmission Control Protocol (TCP) to a different system or media from the system being audited via rsyslog.
- RHEL-10-200644 CAT II RHEL 10 must authenticate the remote logging server for off-loading audit logs via "rsyslog".
- RHEL-10-200645 CAT II RHEL 10 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.
- RHEL-10-200646 CAT II RHEL 10 must encrypt, via the gtls driver, the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.
- RHEL-10-200662 CAT III RHEL 10 must have the "audispd-plugins" package installed.
- RHEL-10-500045 CAT II RHEL 10 must label all off-loaded audit logs before sending them to the central log server.
- RHEL-10-500100 CAT III RHEL 10 must allocate audit record storage capacity to store at least one week's worth of audit records.
- RHEL-10-500115 CAT II RHEL 10 must take appropriate action when the internal event queue is full.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-652010 CAT II RHEL 9 must have the rsyslog package installed.
- RHEL-09-652040 CAT II RHEL 9 must authenticate the remote logging server for offloading audit logs via rsyslog.
- RHEL-09-652045 CAT II RHEL 9 must encrypt the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
- RHEL-09-652050 CAT II RHEL 9 must encrypt via the gtls driver the transfer of audit records offloaded onto a different system or media from the system being audited via rsyslog.
- RHEL-09-652055 CAT II RHEL 9 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.
- RHEL-09-653030 CAT II RHEL 9 must allocate audit record storage capacity to store at least one week's worth of audit records.
- RHEL-09-653060 CAT II RHEL 9 must label all offloaded audit logs before sending them to the central log server.
- RHEL-09-653065 CAT II RHEL 9 must take appropriate action when the internal event queue is full.
- RHEL-09-653130 CAT II RHEL 9 audispd-plugins package must be installed.