STIGQter: STIG Summary: MS SQL Server 2014 Instance Security Technical Implementation Guide Version: 1 Release: 10 Benchmark Date: 24 Apr 2020:

Where availability is paramount, the SQL Server must continue processing (preferably overwriting existing records, oldest first), in the event of lack of space for more Audit/Trace log records; and must keep processing after any failure of an Audit/Trace.

DISA Rule

SV-82277r5_rule

Vulnerability Number

V-67787

Group Title

SRG-APP-000109-DB-000321

Rule Version

SQL4-00-030600

Severity

CAT I

CCI(s)

• CCI-000140 - The information system takes organization-defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).

Weight

10

Fix Recommendation

If SQL Server Audit is in use, configure SQL Server Audit to continue to generate audit records, overwriting the oldest existing records, in the case of an auditing failure.

Run this T-SQL script for each identified audit:

ALTER SERVER AUDIT [AuditName] WITH (STATE = OFF);
GO
ALTER SERVER AUDIT [AuditName] to file (max_rollover_files = IntegerValue);
GO
ALTER SERVER AUDIT [AuditName] WITH (STATE = ON);
GO

Check Contents

If the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA).

If neither SQL Server Audit nor SQL Server Trace is in use for audit purposes, this is a finding.

If SQL Server Audit is in use, review the defined server audits by running the statement:

SELECT [name], [max_rollover_files] FROM sys.server_file_audits
WHERE is_state_enabled = 1;

By observing the [name] and [max_rollover_files] columns, identify the row or rows in use.

If the [max_rollover_files] is greater than zero, this is not a finding. Otherwise, this is a finding.

Vulnerability Number

V-67787

Documentable

False

Rule Version

SQL4-00-030600

Severity Override Guidance

If the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA).

If neither SQL Server Audit nor SQL Server Trace is in use for audit purposes, this is a finding.

If SQL Server Audit is in use, review the defined server audits by running the statement:

SELECT [name], [max_rollover_files] FROM sys.server_file_audits
WHERE is_state_enabled = 1;

By observing the [name] and [max_rollover_files] columns, identify the row or rows in use.

If the [max_rollover_files] is greater than zero, this is not a finding. Otherwise, this is a finding.

Check Content Reference

M

Target Key

2639

Comments