Ubuntu 22.04 LTS must have a crontab script running weekly to offload audit events of standalone systems.
An XCCDF Rule
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity.
- ID
- SV-260587r959008_rule
- Version
- UBTU-22-651035
- Severity
- Low
- References
- Updated
Remediation Templates
A Manual Procedure
Create a script that offloads audit logs to external media and runs weekly.
The script must be located in the "/etc/cron.weekly" directory.