The operating system must invoke a system shutdown in the event of an audit failure, unless an alternative audit capability exists.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-OS-000213-ESXI5-PF	SRG-OS-000213-ESXI5-PF	SRG-OS-000213-ESXI5-PF_rule		Medium

Description
It is critical when an operating system is at risk of failing to process audit logs as required it takes action to mitigate the failure. If the system were to continue processing without auditing enabled, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Applicable, but permanent finding - The hypervisor does not support this functionality. Auditing cannot be configured/implemented like a typical UNIX system. Auditing is turned on by default, as is logging. Syslog is the best way to ensure all access is logged. Access is limited to privileged roles only. In lockdown mode (required), only the vpxuser proxy has access.

Description

It is critical when an operating system is at risk of failing to process audit logs as required it takes action to mitigate the failure. If the system were to continue processing without auditing enabled, actions can be taken on the system that cannot be tracked and recorded for later forensic analysis. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Applicable, but permanent finding - The hypervisor does not support this functionality. Auditing cannot be configured/implemented like a typical UNIX system. Auditing is turned on by default, as is logging. Syslog is the best way to ensure all access is logged. Access is limited to privileged roles only. In lockdown mode (required), only the vpxuser proxy has access.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-SRG-OS-000213-ESXI5-PF_chk )
ESXi does not support this requirement. This is a permanent finding.

Fix Text (F-SRG-OS-000213-ESXI5-PF_fix)
This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.