STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

The TOSS audit records must be offloaded onto a different system or storage media from the system being audited.

DISA Rule

SV-253032r958754_rule

Vulnerability Number

V-253032

Group Title

SRG-OS-000342-GPOS-00133

Rule Version

TOSS-04-030900

Severity

CAT II

CCI(s)

CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

Fix Recommendation

Multiple software applications other than rsyslog may be used by the system to accomplish this requirement. This Fix assumes rsyslog is used for offloading logs from the system.

Configure the operating system to offload audit records onto a different system or media from the system being audited by specifying the remote logging server in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server.

*.* @@[remoteloggingserver]:[port]

Check Contents

Verify the audit system offloads audit records onto a different system or media from the system being audited with the following command:

$ sudo grep @@ /etc/rsyslog.conf /etc/rsyslog.d/*.conf

/etc/rsyslog.conf:*.* @@[remoteloggingserver]:[port]

If a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the audit logs are offloaded to a different system or media.

If there is no evidence that the audit logs are being offloaded to another system or media, this is a finding.

Vulnerability Number

V-253032

Documentable

False

Rule Version

TOSS-04-030900

Severity Override Guidance

Check Content Reference

Target Key

5469