UCF STIG Viewer Logo

ECAR-2 Audit Record Content – Sensitive Systems


Audit records include:   · User ID.   · Successful and unsuccessful attempts to access security files.   · Date and time of the event.   · Type of event.   · Success or failure of event.   · Successful and unsuccessful logons.   · Denial of access resulting from excessive number of logon attempts.   · Blocking or blacklisting a user ID, terminal or access port and the reason for the action.   · Activities that might modify, bypass, or negate safeguards controlled by the system.

MAC / CONF Impact Subject Area
SENSITIVE Medium Enclave Computing Environment


Insufficient security related information recorded in the audit trails cannot support system forensics effectively and efficiently.  This implementation guide is aimed to help system administrators implement the system audit mechanisms properly to provide effective monitoring and detection of the security problems, and security fixes can be implemented in a timely manner.

1. The system administrator shall select audit events against security files of individual system components in accordance with DISA STIGs related to operating system, database, and application, such as excessive number of logon attempt; blocking or blacklisting a user ID; and bypassing or negating safeguards controlled by the system.
2. The system administrator shall configure each audit event to record sufficient information in the audit trails such as date/time of the event, user ID, source, target, type of event, and success/failure.
3. If the system does not provide the capability of recording DOD required security events, the system administrator shall identify and install a DOD approved 3rd party product and configure it in accordance with DISA STIGs and vendor documentation for auditing.
4. The system administrator shall test the auditing capability to ensure that the audit trails record required security events; each event contains sufficient information to support system forensics; and the auditing functions do not affect system operations.


  • CJCSI - Information Assurance (IA) and Computer Network Defense (CND)
  • CJCSM 6510.01, Defense-in-Depth: Information Assurance (IA) and Computer Network Defense (CND), 10 August 2004
  • DISA Windows NT Security Checklist, 10 December 2004
  • DISA Windows 2003 Security Checklist (draft), 10 December 2004
  • DISA Unix STIG, 15 September 2003
  • DISA UNISYS STIG, 22 July 2003
  • DISA Solaris Security Checklist, 20 January 2004
  • DISA Database STIG, 24 July 2004
  • DOD OC/390 RACF Checklist October 2004
  • DOD OC/390 ACF2 Checklist October 2004
  • DOD OC/390 TSS Checklist October 2004
  • NSA Microsoft SQL Server Guides, 02 October 2003
  • NSA Oracle Database Server Guides, 02 October 2003