AU-05 Response to Audit Logging Process Failures
All changes in this version
Title
Response to Audit Logging Process Failures
Control
a. Alert [Assignment: personnel or roles] within [Assignment: time period] in the event of an audit logging process failure; and
b. Take the following additional actions: [Assignment: additional actions].
Discussion
Audit logging process failures include software and hardware errors, failures in audit log capturing mechanisms, and reaching or exceeding audit log storage capacity. Organization-defined actions include overwriting oldest audit records, shutting down the system, and stopping the generation of audit records. Organizations may choose to define additional actions for audit logging process failures based on the type of failure, the location of the failure, the severity of the failure, or a combination of such factors. When the audit logging process failure is related to storage, the response is carried out for the audit log storage repository (i.e., the distinct system component where the audit logs are stored), the system on which the audit logs reside, the total audit log storage capacity of the organization (i.e., all audit log storage repositories combined), or all three. Organizations may decide to take no additional actions after alerting designated roles or personnel.
Parameters
au-05_odp.01: personnel or roles
au-05_odp.02: time period
au-05_odp.03: additional actions
Related controls
au-11, au-12, au-14, au-2, au-4, au-7, au-9, si-12, si-4
STIG rules that implement this control 21
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001010 CAT II The macOS system must be configured to shut down upon audit failure.
- APPL-15-001030 CAT II The macOS system must configure audit capacity warning.
- APPL-15-001031 CAT II The macOS system must configure audit failure notification.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001030 CAT II The macOS system must configure audit capacity warning.
Application Security and Development V6R5
- APSC-DV-001110 CAT II The application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.
- APSC-DV-001120 CAT II The application must shut down by default upon audit failure (unless availability is an overriding concern).
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-653025 CAT III Ubuntu 22.04 LTS must alert the information system security officer (ISSO) and system administrator (SA) in the event of an audit processing failure.
- UBTU-22-653030 CAT II Ubuntu 22.04 LTS must shut down by default upon audit failure.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-900980 CAT III Ubuntu 24.04 LTS must alert the system administrator (SA) and information system security officer (ISSO) (at a minimum) in the event of an audit processing failure.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200690 CAT II RHEL 10 must notify designated personnel if baseline configurations are changed in an unauthorized manner.
- RHEL-10-200691 CAT II RHEL 10 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) of an audit processing failure.
- RHEL-10-500035 CAT II RHEL 10 must take appropriate action when a critical audit processing failure occurs.
- RHEL-10-500210 CAT II RHEL 10 must notify the system administrator (SA) and/or information system security officer (ISSO) (at a minimum) of an audit processing failure.
- RHEL-10-700670 CAT II RHEL 10 must forward mail from postmaster to the root account using a postfix alias.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-252060 CAT II RHEL 9 must forward mail from postmaster to the root account using a postfix alias.
- RHEL-09-653020 CAT II RHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs.
- RHEL-09-653025 CAT II RHEL 9 audit system must take appropriate action when the audit storage volume is full.
- RHEL-09-653055 CAT II RHEL 9 audit system must take appropriate action when the audit files have reached maximum size.
- RHEL-09-653070 CAT II RHEL 9 System Administrator (SA) and/or information system security officer (ISSO) (at a minimum) must be alerted of an audit processing failure event.
- RHEL-09-653125 CAT II RHEL 9 must have mail aliases to notify the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.
- RHEL-09-654265 CAT II RHEL 9 must take appropriate action when a critical audit processing failure occurs.