AccessLogValve must be configured per each virtual host.
An XCCDF Rule
Description
Application servers utilize role-based access controls in order to specify the individuals who are allowed to configure application component loggable events. The application server must be configured to select which personnel are assigned the role of selecting which loggable events are to be logged. Satisfies: SRG-APP-000090-AS-000051, SRG-APP-000095-AS-000056, SRG-APP-000100-AS-000063, SRG-APP-000101-AS-000072, SRG-APP-000503-AS-000228, SRG-APP-000505-AS-000230, SRG-APP-000506-AS-000231
- ID
- SV-222938r960882_rule
- Version
- TCAT-AS-000180
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
As a privileged user on the Tomcat server:
Edit the $CATALINA_BASE/conf/server.xml file.
Create a <Valve> element that is nested beneath the <Host> element containing an AccessLogValve.