Detections
Analytics
TCAT-AS-001560 - AccessLogValve must be configured for Catalina engine.
Information
The <Engine> container represents the entire request processing machinery associated with a particular Catalina Service. It receives and processes all requests from one or more connectors, and returns the completed response to the connector for transmission back to the client. The AccessLogValve will log activity for the Catalina service.Exactly one engine element MUST be nested inside a service element, following all of the corresponding connector elements associated with the service.
Satisfies: SRG-APP-000495-AS-000220, SRG-APP-000381-AS-000089, SRG-APP-000499-AS-000224, SRG-APP-000504-AS-000229
Solution
As a privileged user on the Tomcat server, edit the $CATALINA_BASE/conf/server.xml file.Create a <Valve> element that is nested beneath the <Host> element containing an AccessLogValve.
EXAMPLE:
<Host name='localhost' appBase='webapps'
unpackWARs='true' autoDeploy='false'>
...
<Valve className='org.apache.catalina.valves.AccessLogValve' directory='logs'
prefix='localhost_access_log' suffix='.txt'
pattern='%h %l %t %u "%r" %s %b' />
...
</Host>
Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload
See Also
Item Details
Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT
References: 800-53|AU-12c., 800-53|CM-5(1), CAT|II, CCI|CCI-000172, CCI|CCI-001814, CCI|CCI-003938, Rule-ID|SV-222997r1016518_rule, STIG-ID|TCAT-AS-001560, STIG-Legacy|SV-111517, STIG-Legacy|V-102577, Vuln-ID|V-222997
Plugin: Unix
Control ID: 8a36f442e3bed06b303d322e17757036730f176908d12946ff57fc5d497787be