tc Server ALL must generate log records for system startup and shutdown.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-88817	VROM-TC-000115	SV-99467r1_rule		Medium

Description
Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go un-logged. During start, tc Server reports system messages onto STDOUT and STDERR. These messages will be logged if the initialization script is configured correctly. For historical reasons, the standard log file for this is called “catalina.out”.

Description

Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go un-logged. During start, tc Server reports system messages onto STDOUT and STDERR. These messages will be logged if the initialization script is configured correctly. For historical reasons, the standard log file for this is called “catalina.out”.

STIG	Date
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-88509r1_chk )
At the command prompt, execute the following command: more /storage/log/vcops/log/product-ui/catalina.out Verify that tc Server start and stop events are being logged. If the tc Server start and stop events are not being recorded, this is a finding. Note: The tc Server service is referred to as Catalina in the log.

Fix Text (F-95559r1_fix)
Navigate to and open /opt/pivotal/pivotal-tc-server-standard/tomcat-7.0.57.B.RELEASE/bin/catalina.sh. Navigate to and locate the start block : "elif [ "$1" = "start" ] ; then". Navigate to and locate both “eval” statements: "org.apache.catalina.startup.Bootstrap "$@" start \" Add this statement immediately below both of the “eval” statements: '>> "$CATALINA_OUT" 2>&1 "&"'