The Juniper router must be configured to off-load log records onto a different system than the system being audited.

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

Review the router configuration to verify that it is compliant with this requirement as shown in the example below.

system { syslog { host x.x.x.x { any info; } }

If the router is not configured to off-load log records onto a different system than the system being audited, this is a finding.

Configure the router to send log records to a syslog server as shown in the example below.

[edit system] set syslog host x.x.x.x any info