Logging systems fail quietly. A full disk, a broken agent or an expired credential can leave you with a gap that nobody notices until an investigation needs the data. AU-5 is about noticing, and about deciding in advance what to do.
NIST SP 800-53 Rev 5 binds US federal systems, and others through contract. For other organizations it is a reference.
What the control asks
Alert designated personnel or roles within a time period you define when an audit logging process failure occurs. Then take additional actions you define.
Both the recipients and the time period are organization-defined. So are the follow up actions. Your documentation has to name them.
What it means in practice
NIST's guidance says failures include software and hardware errors, failures in log capturing mechanisms, and reaching or exceeding storage capacity. Example actions include overwriting the oldest records, shutting the system down, or stopping the generation of records. Which is right depends on the system. A payment system might stop; a marketing site probably should keep running and page someone.
The enhancements show how far to go. AU-5.1 Storage Capacity Warning and AU-5.2 Real-time Alerts are the practical ones. AU-5.3 Configurable Traffic Volume Thresholds, AU-5.4 Shutdown on Failure and AU-5.5 Alternate Audit Logging Capability are also listed in the record.
Evidence to collect
- A document naming who is alerted and how fast.
- Alert rule configuration for log pipeline health, agent heartbeat and storage thresholds.
- A record of a test, such as stopping an agent and showing the alert fired.
- Incident or ticket history for real logging failures and their fixes.
- The decision on fail open or fail closed for each critical system.
Common gaps
- Alerts exist for application errors but not for the logging pipeline.
- Nobody owns the alert channel.
- The failure response was never decided, so behavior is accidental.
- No test, so you cannot show the alert works.
- Gaps in logs after an outage were never recorded or explained.
How to implement it
Monitor the logging path end to end. Check that each source sends data, that the collector is healthy and that storage has room. Alert when a source goes silent for longer than a threshold. Route alerts to a team that is on call.
Write the failure policy for each system class. Decide when you accept a gap and when you stop the service. Document the choice and the reasoning.
Run a test twice a year. Disable a forwarder in a safe environment, confirm the alert, and save the screenshot and ticket.
Quick check
Should every system shut down if logging fails?
No. NIST lists shutdown as one example action. Choose based on risk, document it, and make sure someone is alerted either way.
What is the cheapest alert to add first?
A silence alert: if a log source sends nothing for a set period, page someone.
