Automation Controller must allocate log record storage capacity and shut down by default upon log failure (unless availability is an overriding concern).

It is critical that when a system is at risk of failing to process logs, it detects and takes action to mitigate the failure. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. During a failure, the application server must be configured to shut down unless the application server is part of a high availability system.

When availability is an overriding concern, other approved actions in response to a log failure are as follows:

(i) If the failure was caused by the lack of log record storage capacity, the application must continue generating log records if possible (automatically restarting the log service if necessary), overwriting the oldest log records in a first-in-first-out manner.

(ii) If log records are sent to a centralized collection server and communication with this server is lost or the server fails, the application must queue log records locally until communication is restored or until the log records are retrieved manually. Upon restoration of the connection to the centralized collection server, action must be taken to synchronize the local log data with the collection server.

Satisfies: SRG-APP-000109-AS-000068, SRG-APP-000357-AS-000038

As a system administrator (SA) for each Automation Controller host, verify the external logging configuration via the API:

curl -sk -u <admin_user>:<password> https://<controller_fqdn>/api/controller/v2/settings/logging/ | python3 -m json.tool

Verify the following fields are configured per organizational requirements: - LOG_AGGREGATOR_HOST is set to the organizationally defined log aggregator - LOG_AGGREGATOR_PORT is set appropriately - LOG_AGGREGATOR_ENABLED is true

If external logging is not configured, this is a finding.

Verify the local filesystem has adequate capacity for log buffering: df -h /var/log/

If available space does not meet the organizationally defined requirement for log buffering, this is a finding.

As an SA, configure the external log aggregator via the API:

curl -sk -u <admin_user>:<password> -X PATCH -H "Content-Type: application/json" https://<controller_fqdn>/api/controller/v2/settings/logging/ -d '{"LOG_AGGREGATOR_HOST": "<org_log_host>", "LOG_AGGREGATOR_PORT": <port>, "LOG_AGGREGATOR_ENABLED": true}'

Ensure the /var/log/ partition meets the organizationally defined requirement for log buffering capacity.