Detections
Analytics
4.9 Host must transmit audit records to a remote log collector
Information
This control enables the forwarding of audit records from the ESXi host to a designated log collector, aiding in real-time monitoring and analysis. The parameter governing this behavior is Syslog.global.auditRecord.remoteEnable with a recommended setting of TRUE.Centralized logging facilitates a consolidated view of activities across ESXi hosts, enhancing the monitoring and rapid detection of unauthorized or anomalous activities.
Solution
To configure remote logging properly, perform the following from the vSphere web client:- Select the host
- Click Configure then expand System then select Advanced System Settings.
- Select Edit then enter Syslog.global.logHost in the filter.
- Set the Syslog.global.logHost to the hostname or IP address of the central log server.
- Click OK.
Alternately, run the following PowerCLI command:
# Set Syslog.global.logHost for each host
Get-VMHost | Foreach { Set-AdvancedSetting -VMHost $_ -Name Syslog.global.logHost -Value "<NewLocation>" }
Note: When setting a remote log host, it is also recommended to set the "Syslog.global.logDirUnique" to true. You must configure the syslog settings for each host.
Impact:
There is no noted functional impact from enabling this control; however, proper configuration is crucial to ensure reliable log transmission and to maintain the integrity and availability of audit records.
See Also
Item Details
Audit Name: CIS VMware ESXi 8.0 v1.4.0 L1 VMware
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-6(3), CSCv7|6.5
Plugin: VMware
Control ID: 14fd5b8d1f6f26168a7cbd642d0b2f952416173f32aa688b9515adfc95e194d6