VCUI-67-000006 - vSphere UI must generate log records for system startup and shutdown.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.

On the VCSA, the 'vmware-vmon' service starts up the JVMs for various vCenter processes, including vSphere UI, and the individual 'json config' files control the early jvm logging. Ensuring these json files are configured correctly enable early Java stdout and stderr logging.

Satisfies: SRG-APP-000089-WSR-000047, SRG-APP-000092-WSR-000055


Navigate to and open /etc/vmware/vmware-vmon/svcCfgfiles/vsphere-ui.json.

Below the last line of the 'PreStartCommandArg' block, add or reconfigure the following line:

'StreamRedirectFile': '%VMWARE_LOG_DIR%/vmware/vsphere-ui/logs/vsphere-ui-runtime.log',

Restart the appliance for changes to take effect.

See Also

Item Details

References: CAT|II, CCI|CCI-000169, Rule-ID|SV-239687r679167_rule, STIG-ID|VCUI-67-000006, Vuln-ID|V-239687

Plugin: Unix

Control ID: 3a6844202f89df67063fb865bc9d58ea6558311dd5a7b4f9b8e69fcdb2e74e50