Alert on Audit Logging Process Failures

AU-L2-3.3.4 requires organizations to establish and operationalize an alerting mechanism specifically for audit logging process failures, grounded in NIST SP 800-171 Rev 2 requirement 3.3.4. The practice has three concrete components: first, the organization must formally identify which personnel or roles (e.g., ISSO, SOC analyst, system administrator) are responsible for receiving failure alerts; second, it must enumerate the specific failure types that trigger alerts, such as audit service crashes, log storage capacity exhaustion, log forwarding interruptions, or audit subsystem configuration errors; third, the alerting mechanism must function reliably so that identified personnel actually receive notifications in a timely manner when those defined failures occur. The underlying rationale is that an attacker who disables or overwhelms audit logging gains a window of undetected activity, making prompt notification of logging failures a critical defensive control. NIST SP 800-171 Rev 2 ties this requirement to protecting the availability and reliability of the audit function itself, not merely the content of logs.