AOS must generate an immediate real-time alert of all audit failure events requiring real-time alerts.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-266952 | SRG-APP-000360-NDM-000295 | ARBA-ND-000295 | SV-266952r1039877_rule | 2024-10-29 | 1 |
Description
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.
ℹ️ Check
Verify the AOS configuration with the following commands:
show snmp trap-hosts
show snmp trap-list | include wlsxProcessDied
show snmp trap-list | include wlsxProcessRestart
If a SNMP server is not configured and both process traps are not enabled, this is a finding.
✔️ Fix
Configure AOS with the following commands:
configure terminal
snmp-server host <IPv4 or IPv6 address> version <SNMP version> snmp-server host <IPv4 or IPv6 address> version <SNMP version> <SNMPv3 username> engine-id <SNMP engine ID>
snmp-server trap wlsxProcessDied
snmp-server trap wlsxProcessRestart
write memory