Ensure detailed logging is enabled

Trung bìnhCấp 1Xem xét thủ côngnginx

Mô tả

System logging must be configured to meet organizational security and privacy policies. Detailed logs provide the necessary context (event source, timestamp, user, network data) for incident response and forensic analysis. Modern logging strategies favor structured formats (JSON) over unstructured text to facilitate parsing by SIEM solutions. Note ... Manual review: the benchmark gives no reliable automated check for this control.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

1. Verify Log Format Configuration: Inspect the log_format directives in your configuration: nginx -T 2>/dev/null | grep -i "log_format" Evaluation: Confirm that a detailed format (preferably JSON) is defined. Verify that the format includes critical fields: $time_iso8601, $remote_addr, $remote_user, $request, $status, $http_user_agent. 2. Verify Access Log Usage: Check that the defined format is actually used by the access_log directive: nginx -T 2>/dev/null | grep "access_log" Evaluation ...

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Define a detailed log format in the http block of /etc/nginx/nginx.conf. It is highly recommended to use JSON format for compatibility with modern SIEM tools. Recommended Configuration (JSON): http { log_format main_access_json escape=json '{' '"timestamp": "$time_iso8601",' '"remote_addr": "$remote_addr",' '"remote_user": "$remote_user",' '"server_name": "$server_name",' '"request_method": "$request_method",' '"request_uri": "$request_uri",' '"status": $status,' '"body_bytes_sent": $body_bytes_sent,' '"http_referer": "$http_referer",' '"http_user_agent": "$http_user_agent",' '"x_forwarded_for": "$http_x_forwarded_for",' '"request_id": "$request_id"' '}'; # Apply the format globally or per server access_log /var/log/nginx/access.json main_access_json; } Legacy Configuration (Text-based): If JSON is not feasible, ensure the text format captures all necessary fields ...

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: nginxlogging
Tham chiếu: CIS NGINX Benchmark v3.0.0 - 3.1 Ensure detailed logging is enabled