VCPF-80-000014 The vCenter Perfcharts service must produce log records containing sufficient information regarding event details.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

Information

Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success.

Tomcat can be configured with an "AccessLogValve", a component that can be inserted into the request processing pipeline to provide robust access logging. The "AccessLogValve" creates log files in the same format as those created by standard web servers. When "AccessLogValve" is properly configured, log files will contain all the forensic information necessary in the case of a security incident.

Satisfies: SRG-APP-000095-AS-000056, SRG-APP-000016-AS-000013, SRG-APP-000080-AS-000045, SRG-APP-000089-AS-000050, SRG-APP-000090-AS-000051, SRG-APP-000091-AS-000052, SRG-APP-000096-AS-000059, SRG-APP-000097-AS-000060, SRG-APP-000098-AS-000061, SRG-APP-000099-AS-000062, SRG-APP-000100-AS-000063, SRG-APP-000343-AS-000030, SRG-APP-000375-AS-000211, SRG-APP-000495-AS-000220, SRG-APP-000499-AS-000224, SRG-APP-000503-AS-000228

Solution

Navigate to and open:

/usr/lib/vmware-perfcharts/tc-instance/conf/server.xml

Inside the <Host> node, find the "AccessLogValve" <Valve> node and replace the "pattern" element as follows:

pattern="%h %{X-Forwarded-For}i %l %u %t "%r" %s %b "%{User-Agent}i""

Restart the service with the following command:

# vmon-cli --restart perfcharts

Item Details

Audit Name: DISA VMware vSphere 8.0 vCenter Appliance Perfcharts STIG v2r1

Plugin: Unix

Control ID: 0d110901892dbb5e85dcb9311be3fecf5f9b3e30828e5a581e872dbf41752ccc

Detections

Analytics

VCPF-80-000014 The vCenter Perfcharts service must produce log records containing sufficient information regarding event details.

Warning! Audit Deprecated

Information

Solution

See Also

Item Details