The SLES for vRealize must, at a minimum, off-load interconnected systems in real time and off-load standalone systems weekly.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239643	VROM-SL-001470	SV-239643r852615_rule		Medium

Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.

STIG	Date
VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide	2023-09-21

Details

Check Text ( C-42876r662378_chk )
Check the syslog configuration file for remote syslog servers: # cat /etc/syslog-ng/syslog-ng.conf \| grep logserver If no line is returned, or the "logserver" is commented out, this is a finding.

Fix Text (F-42835r662379_fix)
Edit the syslog configuration file and add an appropriate remote syslog server: In the "/etc/syslog-ng/syslog-ng.conf" file, the remote logging entries must be uncommented and the IP address must be modified to point to the remote syslog server: # # Enable this and adopt IP to send log messages to a log server. # #destination logserver { udp("10.10.10.10" port(514)); }; #log { source(src); destination(logserver); };

Fix Text (F-42835r662379_fix)

Edit the syslog configuration file and add an appropriate remote syslog server:

In the "/etc/syslog-ng/syslog-ng.conf" file, the remote logging entries must be uncommented and the IP address must be modified to point to the remote syslog server:

#
# Enable this and adopt IP to send log messages to a log server.
#
#destination logserver { udp("10.10.10.10" port(514)); };
#log { source(src); destination(logserver); };