The system must enable a persistent log location for all locally stored logs.

From VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Part of SRG-OS-000341-VMM-001220

Associated with: CCI-001849

SV-77749r1_rule The system must enable a persistent log location for all locally stored logs.

Vulnerability discussion

ESXi can be configured to store log files on an in-memory file system. This occurs when the host's "/scratch" directory is linked to "/tmp/scratch". When this is done only a single day's worth of logs are stored at any time. In addition log files will be reinitialized upon each reboot. This presents a security risk as user activity logged on the host is only stored temporarily and will not persistent across reboots. This can also complicate auditing and make it harder to monitor events and diagnose issues. ESXi host logging should always be configured to a persistent datastore.Note: Scratch space is configured automatically during installation or first boot of an ESXi host, and does not usually need to be manually configured. ESXi Installable creates a 4 GB Fat16 partition on the target device during installation if there is sufficient space, and if the device is considered Local. If ESXi is installed on an SD card or USB device a persistent log location may not be configured upon install as normal.

Check content

From the vSphere Client select the ESXi Host and go to Configuration >> Advanced Settings. Select the Syslog.global.logDir value and verify it is set to a persistent location. or From a PowerCLI command prompt while connected to the ESXi host run the following commands: Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logDir or $esxcli = Get-EsxCli $esxcli.system.syslog.config.get() | Select LocalLogOutput,LocalLogOutputIsPersistent If the Syslog.global.logDir or LocalLogOutput value is not on persistent storage, this is a finding. If the LocalLogOutputIsPersistent value is not true, this is a finding.

Fix text

From the vSphere Client select the ESXi Host and go to Configuration >> Advanced Settings. Select the Syslog.global.logDir value and set it to a known persistent location. or From a PowerCLI command prompt while connected to the ESXi host run the following commands: Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logDir | Set-AdvancedSetting -Value "New Log Location"

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer