Nutanix OS must be configured to send audit records to a site-specific remote syslog server.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-279567 | NXAC-OS-000089 | SV-279567r1192427_rule | CCI-001851 | low |
| Description | ||||
| Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224 | ||||
| STIG | Date | |||
| Nutanix Acropolis GPOS Security Technical Implementation Guide | 2026-02-24 | |||
Details
Check Text (C-279567r1192427_chk)
Verify there are lines in the "/etc/rsyslog.d/rsyslog-nutanix.conf" files that contain the "@" or "@@" symbol(s) and also lines with the correct symbol(s) to send output a remote log.
$ sudo grep @ /etc/rsyslog.d/rsyslog-nutanix.conf
local0.*; @remote-log-host:514
If the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.
Fix Text (F-84025r1191664_fix)
1. Configure the OS to off-load audit records to a site-specific syslog server by running the following command.
ncli rsyslog-config add-server name=[alias_of_central_host] ip-address=[IP_of_central_host] port=[port_of_central_host] network-protocol=tcp|udp|relp relp-enabled=yes|no; ncli rsyslog-config add-module module-name=syslog_module level=info server-name=[alias_of_central_host]
2. Configure the remote syslog server to perform the following:
- Notify designated personnel if baseline configurations are changed in an unauthorized manner.
- Notify the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
- Notify designated personnel if baseline configurations are changed in an unauthorized manner.
- Notify system administrators and ISSOs when accounts are created.
- Notify system administrators and ISSOs when accounts are modified.
- Notify system administrators and ISSOs when accounts are removed.
- Notify system administrators and ISSOs when accounts are disabled.
- Notify SAs and ISSOs of account enabling actions.