STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS must be configurable to overwrite audit log records, oldest first (First-In-First-Out [FIFO]), in the event of unavailability of space for more audit log records.

DISA Rule

SV-251200r960915_rule

Vulnerability Number

V-251200

Group Title

SRG-APP-000109-DB-000321

Rule Version

RD6X-00-006000

Severity

CAT II

CCI(s)

CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

Fix Recommendation

Redis Enterprise uses the default logrotate daemon to schedule rotation of logs stored on the operating system. The configuration of log rotation may be found at /etc/logrotate.d.

By default, the log rotation should occur on a daily basis. Redis Labs recommends sending log files to a remote logging server so that they can be more effectively maintained.

To modify the log rotation policy perform the following steps:
1. sudo vi /etc/logrotate.conf (The location of the log rotation configuration may vary depending on operating system distribution.)
2. Modify the log rotation configuration to meet the needs of the application.

Check Contents

Redis Enterprise uses the default logrotate daemon to schedule rotation of logs stored on the operating system. The configuration of log rotation may be found at /etc/logrotate.d.

By default, the log rotation should occur on a daily basis. Redis Labs recommends sending log files to a remote logging server so that they can be more effectively maintained.

To check the log rotation policy, perform the following steps:
1. sudo cat /etc/logrotate.conf (The location of the log rotation configuration may vary depending on operating system distribution.)
2. Investigate the log rotation policy to verify that the appropriate policy is applied for all logs.

Check to verify that log rotation is not disabled and is appropriate for the application by investigating the logrotated configuration. If log rotation is not enabled or is not configured appropriately, this is a finding.

Vulnerability Number

V-251200

Documentable

False

Rule Version

RD6X-00-006000

Severity Override Guidance

Redis Enterprise uses the default logrotate daemon to schedule rotation of logs stored on the operating system. The configuration of log rotation may be found at /etc/logrotate.d.

By default, the log rotation should occur on a daily basis. Redis Labs recommends sending log files to a remote logging server so that they can be more effectively maintained.

To check the log rotation policy, perform the following steps:
1. sudo cat /etc/logrotate.conf (The location of the log rotation configuration may vary depending on operating system distribution.)
2. Investigate the log rotation policy to verify that the appropriate policy is applied for all logs.

Check to verify that log rotation is not disabled and is appropriate for the application by investigating the logrotated configuration. If log rotation is not enabled or is not configured appropriately, this is a finding.

Check Content Reference

Target Key

5443