The Ubuntu operating system must be configured to preserve log records from failure events.
An XCCDF Rule
Description
Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving operating system state information helps to facilitate operating system restart and return to the operational mode of the organization with least disruption to mission/business processes.
- ID
- SV-238353r991562_rule
- Version
- UBTU-20-010432
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the log service to collect failure events.
Install the log service (if the log service is not already installed) with the following command:
$ sudo apt-get install rsyslog