Title

The Tomcat server must generate log records containing information that establishes the identity of any individual or process associated with the event. (Cat II impact)

Discussion

Information system logging capability is critical for accurate forensic analysis. Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Application servers have differing levels of logging capabilities that can be specified by setting a verbosity level. The application server must, at a minimum, be capable of establishing the identity of any user or process that is associated with any particular event.

Check Content

Review the server.xml configuration file for an entry for the AccessLogValve. An example looks like: <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t %r %s %b"/> If the %u or comman is not included in the pattern, this is a finding. If the AccessLogValve line does not exist in the server.xml, this is a finding.

Fix Text

Configure the Tomcat server logging system to log the identity of the user or process related to the events.

Additional Identifiers

Rule ID: SV-46469r3_rule

Vulnerability ID: V-35182

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.