Check: VCEM-67-000006
VMware vSphere 6.7 EAM Tomcat STIG:
VCEM-67-000006
(in versions v1 r4 through v1 r1)
Title
ESX Agent Manager must generate log records for system startup and shutdown. (Cat II impact)
Discussion
Logging must be started as soon as possible when a service starts and as late as possible when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.
Check Content
At the command prompt, execute the following command: # grep StreamRedirectFile /etc/vmware/vmware-vmon/svcCfgfiles/eam.json Expected output: "StreamRedirectFile" : "%VMWARE_LOG_DIR%/vmware/eam/jvm.log", If no log file is specified for the "StreamRedirectFile" setting, this is a finding.
Fix Text
Navigate to and open: /etc/vmware/vmware-vmon/svcCfgfiles/eam.json Below the last line of the "PreStartCommandArg" block, add the following line: "StreamRedirectFile" : "%VMWARE_LOG_DIR%/vmware/eam/jvm.log", Restart the appliance for changes to take effect.
Additional Identifiers
Rule ID: SV-239377r879559_rule
Vulnerability ID: V-239377
Group Title: SRG-APP-000089-WSR-000047
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000169 |
The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components. |
Controls
Number | Title |
---|---|
AU-12 |
Audit Generation |