AIX sendmail logging must not be set to less than nine in the sendmail.cf file.

If Sendmail is not configured to log at level 9, system logs may not contain the information necessary for tracking unauthorized use of the sendmail service.

Check if "Sendmail" logging is set to level "9" by running command:

# grep "^O LogLevel" /etc/mail/sendmail.cf O LogLevel=9

If logging is set to less than "9", this is a finding.

Edit /etc/mail/sendmail.cf file, locate the "O LogLevel" line, or add a new line if necessary, and change the log level to "9". The new LogLevel line should be: O LogLevel=9