STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.

DISA Rule

SV-253776r961860_rule

Vulnerability Number

V-253776

Group Title

SRG-APP-000515-DB-000318

Rule Version

MADB-10-012400

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

To set up the audit logs to write to sylog:

Edit the mariadb-enterprise.cnf file. Add the following under the [mariadb] section:

server_audit_output_type = 'syslog'

After the .cnf file is updated and saved, the mariadb database service must be restarted.

Check Contents

Check if the variable server_audit_output_type is set to syslog, and verify the operating system is using a centralized syslog utility such as rsyslogd.

MariaDB> SHOW GLOBAL VARIABLES LIKE 'server_audit_output_type';

If not, this is a finding.

Vulnerability Number

V-253776

Documentable

False

Rule Version

MADB-10-012400

Severity Override Guidance

Check if the variable server_audit_output_type is set to syslog, and verify the operating system is using a centralized syslog utility such as rsyslogd.

MariaDB> SHOW GLOBAL VARIABLES LIKE 'server_audit_output_type';

If not, this is a finding.

Check Content Reference

M

Target Key

5475