VCEM-67-000005 - ESX Agent Manager must record user access in a format that enables monitoring of remote access.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success.

Tomcat can be configured with an 'AccessLogValve', a component that can be inserted into the request processing pipeline to provide robust access logging. The AccessLogValve creates log files in the same format as those created by standard web servers. When AccessLogValve is properly configured, log files will contain all the forensic information necessary in the case of a security incident.

Satisfies: SRG-APP-000016-WSR-000005, SRG-APP-000089-WSR-000047, SRG-APP-000092-WSR-000055, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000098-WSR-000060, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171


Navigate to and open:


Add the following line at the very top of the <Host> node.

<Valve className='org.apache.catalina.valves.RemoteIpValve' httpServerPort='80' httpsServerPort='443' protocolHeader='x-forwarded-proto' proxiesHeader='x-forwarded-by' remoteIpHeader='x-forwarded-for' requestAttributesEnabled='true' internalProxies=''/>

Inside the <Host> node, remove the existing 'AccessLogValve' <Valve> node entirely and replace it with the following line:

<Valve className='org.apache.catalina.valves.AccessLogValve' directory='${eam.catalina.logdir}' pattern='%h %{X-Forwarded-For}i %l %u %t [%I] &quot;%r&quot; %s %b [Processing time %D msec] &quot;%{User-Agent}i&quot;' resolveHosts='false' prefix='localhost_access_log' suffix='.txt'/>

See Also