Envoy log files must be shipped via syslog to a central log server.

An XCCDF Rule

Description

<VulnDiscussion>Envoy rsyslog configuration is included in the "VMware-visl-integration" package and unpacked to "/etc/vmware-syslog/vmware-services-envoy.conf". Ensuring the package hashes are as expected also ensures the shipped rsyslog configuration is present and unmodified.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-256744r889170_rule
Severity: Medium
References: CCI-001851
Updated: 9 months ago

Navigate to and open: 
 
/etc/vmware-syslog/vmware-services-envoy.conf 
 
Create the file if it does not exist. 
 Set the contents of the file as follows: 
 
#envoy service log 
input(type="imfile" 
      File="/var/log/vmware/envoy/envoy.log" 
      Tag="envoy-main" 
      Severity="info" 
      Facility="local0") 
#envoy access log 
input(type="imfile" 
      File="/var/log/vmware/envoy/envoy-access.log" 
      Tag="envoy-access" 
      Severity="info" 
      Facility="local0")

Envoy log files must be shipped via syslog to a central log server.

Description

Remediation - Manual Procedure