Detections
Analytics

4.6 Host must enable audit record logging

Information

Enabling audit record logging on ESXi hosts ensures the local storage of audit records, providing a trail of activities performed on the host. This measure is pivotal for accountability, troubleshooting, and security investigations. The parameter governing this behavior is Syslog.global.auditRecord.storageEnable with a recommended setting of TRUE.

Enabling audit record logging is crucial for maintaining a secure and compliant operational environment. It provides visibility into host activities, aiding in identifying and investigating unauthorized or malicious actions.

Solution

To enable local audit-record logging:

 - Execute command: esxcli system auditrecords local enable
 - Verify remediation with: esxcli system auditrecords get
 - passing results: Audit Record Storage Active: true

Impact:

While beneficial for security and compliance, enabling audit record logging consumes additional storage space on the host, which may necessitate enhanced storage management practices to ensure optimal performance.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.3, CSCv7|6.4

Plugin: Unix

Control ID: e0bae4d4747503992b5320d2ce279764412539010157a00691f43f30e5155373