STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must off-load audit records to a central log server.

DISA Rule

SV-278396r1172699_rule

Vulnerability Number

V-278396

Group Title

SRG-APP-000358

Rule Version

NGNX-APP-001400

Severity

CAT I

CCI(s)

CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.
CCI-001348 - Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component that the system or component being audited.

Weight

Fix Recommendation

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Include the "syslog:server= prefix" (which can be a domain name, an IP address, or a UNIX-domain socket path. A domain name or IP address can be specified with a port to override the default port, 514. A UNIX-domain socket path can be specified after the unix: prefix:) in any log directives and configure the optional parameters (facility, tag, severity).

After saving the configuration, reload NGINX:

# nginx -s reload

Check Contents

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify that "syslog:server= prefix" is included in any log directive:

# cat <path to config>

Find the "error_log: or "access_log" directives and verify the syslog:server= prefix is included.

If "error_log" or "access_log" exists and does not include "syslog:server=", this is a finding.

Vulnerability Number

V-278396

Documentable

False

Rule Version

NGNX-APP-001400

Severity Override Guidance

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Verify that "syslog:server= prefix" is included in any log directive:

# cat <path to config>

Find the "error_log: or "access_log" directives and verify the syslog:server= prefix is included.

If "error_log" or "access_log" exists and does not include "syslog:server=", this is a finding.

Check Content Reference

Target Key

5720