Skip to content

vSphere UI must generate log records for system startup and shutdown.

An XCCDF Rule

Description

<VulnDiscussion>Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged. On the vCenter Server Appliance (VCSA), the "vmware-vmon" service starts up the Java virtual machines (JVMs) for various vCenter processes, including vSphere UI, and the individual json configuration files control the early JVM logging. Ensuring these json files are configured correctly enables early Java "stdout" and "stderr" logging. Satisfies: SRG-APP-000089-WSR-000047, SRG-APP-000092-WSR-000055</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID
SV-256783r889348_rule
Severity
Medium
References
Updated



Remediation - Manual Procedure

Navigate to and open: 
 
/etc/vmware/vmware-vmon/svcCfgfiles/vsphere-ui.json 
 
Below the last line of the "PreStartCommandArg" block, add or reconfigure the following line: