Detections
Analytics
VCLD-70-000006 - VAMI must produce log records containing sufficient information to establish what type of events occurred.
Information
After a security incident has occurred, investigators will often review log files to determine what happened. Understanding what type of event occurred is critical for investigation of a suspicious event.Satisfies: SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171
Solution
Navigate to and open:/opt/vmware/etc/lighttpd/lighttpd.conf
Comment any existing 'accesslog.format' lines by adding a '#' at the beginning of the line.
Restart the service with the following command:
# vmon-cli --restart applmgmt
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere 7.0 VAMI v1r2
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-3, 800-53|AU-8b., CAT|II, CCI|CCI-000130, CCI|CCI-000131, CCI|CCI-000132, CCI|CCI-000133, CCI|CCI-000134, CCI|CCI-001487, CCI|CCI-001889, CCI|CCI-001890, Rule-ID|SV-256650r888472_rule, STIG-ID|VCLD-70-000006, Vuln-ID|V-256650
Plugin: Unix
Control ID: f31b6aec42b99162765f129194bc2a155eee8d1df78b5c9dd3d818593138d12d