STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

TOSS 5 must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog.

DISA Rule

SV-282617r1201621_rule

Vulnerability Number

V-282617

Group Title

SRG-OS-000479-GPOS-00224

Rule Version

TOSS-05-000384

Severity

CAT II

CCI(s)

CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

Fix Recommendation

Configure TOSS 5 to offload audit records onto a different system or media from the system being audited via TCP using rsyslog by specifying the remote logging server in "/etc/rsyslog.conf"" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server.

*.* @@[remoteloggingserver]:[port]"

Check Contents

Verify TOSS 5 audit system offloads audit records onto a different system or media from the system being audited via rsyslog using TCP using the following command:

$ sudo grep @@ /etc/rsyslog.conf /etc/rsyslog.d/*.conf

/etc/rsyslog.conf:*.* @@[remoteloggingserver]:[port]

If a remote server is not configured, or the line is commented out, ask the system administrator (SA) to indicate how the audit logs are offloaded to a different system or media.

If there is no evidence that the audit logs are being offloaded to another system or media, this is a finding.

Vulnerability Number

V-282617

Documentable

False

Rule Version

TOSS-05-000384

Severity Override Guidance

Check Content Reference

Target Key

5738