Detections
Analytics

4.7 Host must configure a persistent log location for all locally stored audit records

Information

Configuring a persistent log location for locally stored audit records on ESXi hosts is critical to ensure audit continuity. When the "/scratch" directory is linked to "/tmp/scratch", only a day's worth of records are retained, and they are reinitialized upon each reboot, creating a security risk. A persistent datastore, except a vSAN datastore, should be designated for audit record logging to preserve records across reboots. The parameter governing this behavior is Syslog.global.auditRecord.storageDirectory.

A persistent log location safeguards audit records, enhancing the auditability and diagnosability of system events. This setup helps in adhering to compliance requirements and facilitating future audits.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure a persistent datastore location with:

esxcli system auditrecords local set \ --directory=/vmfs/volumes/<Datastore-UUID>/audit/<hostname>

then

esxcli system auditrecords local enable

verify compliance with:
esxcli system auditrecords get

compliant results =
Audit Record Storage Active: true
Audit Record Storage Directory: /vmfs/volumes/<Datastore-UUID>/audit/<hostname>

Impact:

Implementing this control will consume additional storage space for logs, necessitating a balanced approach to storage management, especially when local non-vSAN storage options are limited.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-6(3), CSCv7|6.5

Plugin: Unix

Control ID: 59b6bfbc5531687eef4f27defc5cbb7e7a745f8b77232a0e4118cff250f60c85