Detections
Analytics

1.6 ESXI-80-000015

Information

The ESXi must produce audit records containing information to establish what type of events occurred.

GROUP ID: V-258733
RULE ID: SV-258733r958412

Without establishing what types of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.

Satisfies: SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310

Solution

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Click "Edit". Select the "Config.HostAgent.log.level" value and configure it to "info".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level | Set-AdvancedSetting -Value "info"

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-12b., CAT|II, CCI|CCI-000130, CCI|CCI-000171, Rule-ID|SV-258733r958412_rule, STIG-ID|ESXI-80-000015, Vuln-ID|V-258733

Plugin: VMware

Control ID: 54a290b62810b13b268984dbd9edd4b5653d7f0151c20ac5d742ad3110409517