The Juniper EX switch must be configured to off-load audit records onto a different system than the system being audited.

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity. Archiving is not required unless space is limited in the audit server.

Verify an external syslog server is configured. The lowest severity level, "any", is debug and will generate a significant number of messages.

[edit system syslog] host <external syslog address> { any info; structured-format; << Only if structured formatting is required, otherwise events are recorded in standard format. } time-format year;

If the device does not offload audit records to an external syslog server, this is a finding.

Configure syslog host

set system syslog host <external syslog host IPv4 or IPv6 address> any info