STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must allocate audit record storage capacity to store at least one week's worth of audit records, when audit records are not immediately sent to a central audit record storage facility.

DISA Rule

SV-279566r1192425_rule

Vulnerability Number

V-279566

Group Title

SRG-OS-000341-GPOS-00132

Rule Version

NXAC-OS-000088

Severity

CAT III

CCI(s)

• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.

Weight

10

Fix Recommendation

1. For AOS, configure the audit rules.

$ sudo salt-call state.sls security/CVM/auditCVM

2. For Prism Central, configure the audit rules.

$ sudo salt-call state.sls security/PCVM/auditPCVM

3. For Files, configure the audit rules.

$ sudo salt-call state.sls security/AFS/auditAFS

4. For AHV, configure the audit rules.

$ sudo salt-call state.sls security/KVM/auditKVM

Check Contents

Verify Nutanix OS preconfigures storage for one week's worth of audit records when audit records are not immediately sent to a central audit record facility using the following command.

$ sudo cat /boot/grub/grub.conf | grep audit_backlog_limit
audit_backlog_limit=8192

If the "audit_backlog_limit" entry does not equal "8192", is missing, or the line is commented out, this is a finding.

Vulnerability Number

V-279566

Documentable

False

Rule Version

NXAC-OS-000088

Severity Override Guidance

Verify Nutanix OS preconfigures storage for one week's worth of audit records when audit records are not immediately sent to a central audit record facility using the following command.

$ sudo cat /boot/grub/grub.conf | grep audit_backlog_limit
audit_backlog_limit=8192

If the "audit_backlog_limit" entry does not equal "8192", is missing, or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

5730