STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.

DISA Rule

SV-280988r1195374_rule

Vulnerability Number

V-280988

Group Title

SRG-OS-000342-GPOS-00133

Rule Version

RHEL-10-200645

Severity

CAT II

CCI(s)

CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

Fix Recommendation

Configure RHEL 10 to encrypt off-loaded audit records via rsyslog by enabling TLS within the "omfwd" action rule.

Edit the configuration file containing the "omfwd" rule (e.g., /etc/rsyslog.d/99-forwarding.conf) and add the tls="on" parameter.

Example:
action(
type="omfwd"
target="logserver.example.com"
protocol="tcp"
port="6514"
tls="on"
)

After applying the configuration, restart the rsyslog service:
$ sudo systemctl restart rsyslog

Check Contents

Verify RHEL 10 encrypts audit records offloaded onto a different system via rsyslog using the modern "omfwd" action.

Search for active TLS-enabling configurations within "omfwd" action blocks with the following command:

$ sudo grep -rE 'tls="on"|StreamDriver.Mode\s*=\s*"1"' /etc/rsyslog.conf /etc/rsyslog.d/

If an active TCP-based "omfwd" forwarding rule exists on the system but the command above returns no active configuration lines, or if all results are commented out, this is a finding.

Vulnerability Number

V-280988

Documentable

False

Rule Version

RHEL-10-200645

Severity Override Guidance

Check Content Reference

Target Key

5733