The Juniper EX switch must be configured to off-load audit records onto a different system than the system being audited.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-253937 | JUEX-NM-000600 | SV-253937r1212008_rule | CCI-001851 | medium |
| Description | ||||
| Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Archiving is not required unless space is limited in the audit server. | ||||
| STIG | Date | |||
| Juniper EX Series Switches Network Device Management Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-253937r1212008_chk)
Verify an external syslog server is configured. The lowest severity level, "any", is debug and will generate a significant number of messages.
[edit system syslog]
host <external syslog address> {
any info;
structured-format; << Only if structured formatting is required, otherwise events are recorded in standard format.
}
time-format year;
If the device does not offload audit records to an external syslog server, this is a finding.
Fix Text (F-57340r1212007_fix)
Configure syslog host
set system syslog host <external syslog host IPv4 or IPv6 address> any info