TCAT-AS-000240 - Date and time of events must be logged.


The access logfile format is defined within a Valve that implements the org.apache.catalina.valves.AccessLogValve interface within the /opt/tomcat/server.xml configuration file: The %t pattern code is included in the pattern element and logs the date and time of the event. Including the date pattern in the log configuration provides useful information about the time of the event which is critical for troubleshooting and forensic investigations.


As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Modify the <Valve> element(s) nested within the <Host> element(s).

Change the AccessLogValve setting to include %t in the pattern= statement.

<Host name='localhost' appBase='webapps'
unpackWARs='true' autoDeploy='false'>
<Valve className='org.apache.catalina.valves.AccessLogValve' directory='logs'
prefix='localhost_access_log' suffix='.txt'
pattern='%h %l %t %u &quot;%r&quot; %s %b' />

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload

See Also

Item Details


References: 800-53|AU-3, CAT|II, CCI|CCI-000131, Rule-ID|SV-222939r615938_rule, STIG-ID|TCAT-AS-000240, STIG-Legacy|SV-111407, STIG-Legacy|V-102461, Vuln-ID|V-222939

Plugin: Unix

Control ID: 97047e727895edbbe7c39820fcde8ae18ac102ff9177884c5e1e96a5ef21e005