V-38520: The operating system must back up audit records on an organization defined frequency onto a different system or media than the system being audited.
-------------------------------------------------------------------------------------------------------------------------------------------------------------

A log server (loghost) receives syslog messages from one or more systems. This
data can be used as an additional log source in the event a system is
compromised and its local logs are suspect. Forwarding log messages to a
remote loghost also provides system administrators with a centralized place to
view the status of multiple hosts within the enterprise.

Details: `V-38520 in STIG Viewer`_.

.. _V-38520 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38520

Notes for deployers
~~~~~~~~~~~~~~~~~~~

.. include:: developer-notes/V-38520.rst