Check: VCPF-67-000006
VMware vSphere 6.7 Perfcharts Tomcat STIG:
VCPF-67-000006
(in versions v1 r3 through v1 r1)
Title
Performance Charts must generate log records for system startup and shutdown. (Cat II impact)
Discussion
Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged. On the VCSA, the "vmware-vmon" service starts up the Java virtual machines (JVMs) for various vCenter processes, including Performance Charts, and the individual "json" config files control the early JVM logging. Ensuring these "json" files are configured correctly enables early Java "stdout" and "stderr" logging. Satisfies: SRG-APP-000089-WSR-000047, SRG-APP-000092-WSR-000055
Check Content
At the command prompt, execute the following command: # grep StreamRedirectFile /etc/vmware/vmware-vmon/svcCfgfiles/perfcharts.json Expected result: "StreamRedirectFile" : "%VMWARE_LOG_DIR%/vmware/perfcharts/vmware-perfcharts-runtime.log", If the output does not match the expected result, this is a finding.
Fix Text
Navigate to and open /etc/vmware/vmware-vmon/svcCfgfiles/perfcharts.json. Below the last line of the "PreStartCommandArg" block, add the following line: "StreamRedirectFile" : "%VMWARE_LOG_DIR%/vmware/perfcharts/vmware-perfcharts-runtime.log", Restart the appliance for changes to take effect.
Additional Identifiers
Rule ID: SV-239407r879559_rule
Vulnerability ID: V-239407
Group Title: SRG-APP-000089-WSR-000047
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000163 |
The information system protects audit information from unauthorized modification. |
CCI-000169 |
The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components. |
CCI-001464 |
The information system initiates session audits at system start-up. |