The NSX-T Manager must be configured to send logs to a central log server.

An XCCDF Rule

Description

<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-251787r879886_rule
Severity: Medium
References: CCI-001851
Updated: about 1 year ago

(Optional) From an NSX-T Manager shell, run the following command(s) to clear any existing incorrect logging-servers:

> clear logging-servers

From an NSX-T Manager shell, run the following command(s) to configure a tcp syslog server:
> set logging-server <server-ip or server-name> proto tcp level info

From an NSX-T Manager shell, run the following command(s) to configure a tls syslog server:

> set logging-server <server-ip or server-name> proto tls level info serverca ca.pem clientca ca.pem certificate cert.pem key key.pem

From an NSX-T Manager shell, run the following command(s) to configure an li-tls syslog server:

> set logging-server <server-ip or server-name> proto li-tls level info serverca root-ca.crt

Note: If using the protocols TLS or LI-TLS to configure a secure connection to a log server, the server and client certificates must be stored in /image/vmware/nsx/file-store on each NSX-T Manager appliance.

The NSX-T Manager must be configured to send logs to a central log server.

Description

Remediation - Manual Procedure