Detections
Analytics

4.7 Host must configure a persistent log location for all locally stored audit records

Information

Configuring a persistent log location for locally stored audit records on ESXi hosts is critical to ensure audit continuity. When the "/scratch" directory is linked to "/tmp/scratch", only a day's worth of records are retained, and they are reinitialized upon each reboot, creating a security risk. A persistent datastore, except a vSAN datastore, should be designated for audit record logging to preserve records across reboots. The parameter governing this behavior is Syslog.global.auditRecord.storageDirectory.

A persistent log location safeguards audit records, enhancing the auditability and diagnosability of system events. This setup helps in adhering to compliance requirements and facilitating future audits.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure a persistent datastore location with:

esxcli system auditrecords local set \ --directory=/vmfs/volumes/<Datastore-UUID>/audit/<hostname>

then

esxcli system auditrecords local enable

verify compliance with:
esxcli system auditrecords get

compliant results =
Audit Record Storage Active: true
Audit Record Storage Directory: /vmfs/volumes/<Datastore-UUID>/audit/<hostname>

Impact:

Implementing this control will consume additional storage space for logs, necessitating a balanced approach to storage management, especially when local non-vSAN storage options are limited.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-6(3), CSCv7|6.5

Plugin: Unix

Control ID: 9d86aa9148ed2fb0c4cc89d506afdf2d3aa82fd42ed66f0917e0753e38548104