Detections
Analytics

4.4 Host must set the logging informational level to info

Information

Set the logging informational level to "info" via the Config.HostAgent.log.level parameter to ensure audit logs contain adequate data for diagnostics and forensics. This level provides a balanced amount of detail, suitable for routine analysis and investigation. The parameter governing this behavior is Config.HostAgent.log.level with a recommended setting of info.

The "info" level balances the detail in logs, aiding in diagnostics and forensics without overwhelming storage resources.

Solution

Using the vSphere client:

Host
-> Configure
-> System
-> Advanced System Settings
-> Syslog.global.logLevel

Set: info

Execute command: esxcli system syslog config get | grep "Log Level"
Verify - Log Level: info

Impact:

A more verbose log level increases data volume, demanding additional storage, while a less verbose level may lack crucial information for effective diagnostics and forensics.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-4, 800-53|AU-7, 800-53|AU-12, CSCv7|6.3, CSCv7|6.4

Plugin: Unix

Control ID: ca5c2f2a178da6209c14aa9fd54cace3b10f2d515fa0c52c557dda2ce1660f40