documentation_complete: true

prodtype: rhel7

title: 'Configure audispd Plugin To Send Logs To Remote Server'

description: |-
    Configure the audispd plugin to off-load audit records onto a different
    system or media from the system being audited.
    Set the <tt>remote_server</tt> option in <pre>/etc/audisp/audisp-remote.conf</pre>
    with an IP address or hostname of the system that the audispd plugin should
    send audit records to. For example replacing <i>REMOTE_SYSTEM</i> with an IP
    address or hostname:
    <pre>remote_server = <i>REMOTE_SYSTEM</i></pre>

rationale: |-
    Information stored in one location is vulnerable to accidental or incidental
    deletion or alteration.Off-loading is a common process in information systems
    with limited audit storage capacity.

severity: medium

identifiers:
    cce: 80541-6

references:
    disa: 1851
    nist: ""
    srg: SRG-OS-000342-GPOS-00133
    stigid: "030300"

ocil_clause: 'audispd is not sending logs to a remote system'

ocil: |-
    To verify the audispd plugin off-loads audit records onto a different system or
    media from the system being audited, run the following command:
    <pre>$ sudo grep -i remote_server /etc/audisp/audisp-remote.conf</pre>
    The output should return something similar to where <i>REMOTE_SYSTEM</i>
    is an IP address or hostname:
    <pre>remote_server = <i>REMOTE_SYSTEM</i></pre>
