UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

AccessLogValve must be configured for Catalina engine.


Overview

Finding ID Version Rule ID IA Controls Severity
V-222997 TCAT-AS-001560 SV-222997r615938_rule Medium
Description
The <Engine> container represents the entire request processing machinery associated with a particular Catalina Service. It receives and processes all requests from one or more Connectors, and returns the completed response to the Connector for transmission back to the client. The AccessLogValve will log activity for the Catalina service. Exactly one Engine element MUST be nested inside a Service element, following all of the corresponding Connector elements associated with the Service. Satisfies: SRG-APP-000495-AS-000220, SRG-APP-000381-AS-000089, SRG-APP-000499-AS-000224, SRG-APP-000504-AS-000229
STIG Date
Apache Tomcat Application Sever 9 Security Technical Implementation Guide 2021-06-15

Details

Check Text ( C-24669r426435_chk )
As an elevated user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Review the element. Ensure one AccessLog element is nested within the Engine element.

If a element is not defined, this is a finding.

EXAMPLE:

...
prefix="catalina_access_log" suffix=".txt"
pattern="common"/>
...
Fix Text (F-24658r426436_fix)
As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Create a element that is nested beneath the element containing an AccessLogValve.

EXAMPLE:
unpackWARs="true" autoDeploy="false">
...
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %t %u "%r" %s %b" />
...


Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload