STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SLEM 5 must offload rsyslog messages for networked systems in real time and offload standalone systems at least weekly.

DISA Rule

SV-261409r996643_rule

Vulnerability Number

V-261409

Group Title

SRG-OS-000479-GPOS-00224

Rule Version

SLEM-05-652010

Severity

CAT II

CCI(s)

CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

Fix Recommendation

Configure SLEM 5 to offload syslog-ng messages for networked systems in real time.

For standalone systems establish a procedure to offload log messages at least once a week.

For networked systems add a "UDP_OR_TCP("IP_ADDRESS" port(514)); };"
"#log { source(src); destination(logserver); };" in "/etc/syslog-ng/syslog-ng.conf" that does not have one.

syslog("10.10.10.10" transport("udp") port(514)); };

Check Contents

Verify that SLEM 5 must offload syslog-ng messages for networked systems in real time and offload standalone systems at least weekly.

For standalone hosts, verify with the system administrator that the log files are offloaded at least weekly.

For networked systems, check that syslog-ng is sending log messages to a remote server with the following command:

> sudo egrep "^destination logserver" /etc/syslog-ng/syslog-ng.conf
syslog("10.10.10.10" transport("udp") port(514)); };

If any active message labels in the file do not have a line to send log messages to a remote server, this is a finding.

Vulnerability Number

V-261409

Documentable

False

Rule Version

SLEM-05-652010

Severity Override Guidance

Check Content Reference

Target Key

5596