OpenControls Logo

STIG Viewer

STIGViewer Support

ONTAP must have audit guarantee enabled.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-246935NAOT-AU-000003SV-246935r961401_ruleCCI-001858medium
Description
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. With audit guarantee enabled, all SMB operations must generate an audit event before an ACK is returned to the client and the operation completed. If the audit event cannot be written, then the client operation is delayed or denied.
STIGDate
NetApp ONTAP DSC 9.x Security Technical Implementation Guide2026-05-23

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-05.1Real-Time Alerts of Event Logging Failure
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (22) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(4)Automated Audit Actions
1.00
AU-12Audit Record Generation
1.00
AU-14(1)System Start-up
1.00
AU-3Content of Audit Records
1.00
AU-3(1)Additional Audit Information
1.00
AU-4Audit Log Storage Capacity
1.00
AU-4(1)Transfer to Alternate Storage
1.00
AU-5Response to Audit Logging Process Failures
1.00
AU-5(1)Storage Capacity Warning
1.00
AU-5(2)Real-time Alerts
1.00

+12 more (top 10 by confidence shown)

CCI1 mapping
CCI-001858
1.00

Details

Check Text (C-246935r961401_chk)

Use "vserver audit show -fields audit-guarantee" to see if audit guarantee is enabled. If audit-guarantee is set to false, this is a finding.

Fix Text (F-50321r856967_fix)

Use the command "vserver audit modify -vserver <vserver_name> -destination <audit log location> -audit-guarantee true" to set audit-guarantee to true. An example command for a vserver named svm01 with the audit logs at /audit_log would be "vserver audit modify -vserver svm01 -destination /audit_log -audit-guarantee true". Use the command "vserver audit show -fields audit-guarantee" to verify the change.