Nutanix OS must be configured to send audit records to a site-specific remote syslog server.

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

Verify there are lines in the "/etc/rsyslog.d/rsyslog-nutanix.conf" files that contain the "@" or "@@" symbol(s) and also lines with the correct symbol(s) to send output a remote log. $ sudo grep @ /etc/rsyslog.d/rsyslog-nutanix.conf local0.*; @remote-log-host:514 If the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.

1. Configure the OS to off-load audit records to a site-specific syslog server by running the following command. ncli rsyslog-config add-server name=[alias_of_central_host] ip-address=[IP_of_central_host] port=[port_of_central_host] network-protocol=tcp|udp|relp relp-enabled=yes|no; ncli rsyslog-config add-module module-name=syslog_module level=info server-name=[alias_of_central_host] 2. Configure the remote syslog server to perform the following: - Notify designated personnel if baseline configurations are changed in an unauthorized manner. - Notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. - Notify designated personnel if baseline configurations are changed in an unauthorized manner. - Notify system administrators and ISSOs when accounts are created. - Notify system administrators and ISSOs when accounts are modified. - Notify system administrators and ISSOs when accounts are removed. - Notify system administrators and ISSOs when accounts are disabled. - Notify SAs and ISSOs of account enabling actions.