tc Server UI must produce log records containing sufficient information to establish when (date and time) events occurred.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-88839	VROM-TC-000170	SV-99489r1_rule		Medium

Description
After a security incident has occurred, investigators will often review log files to determine when events occurred. Understanding the precise sequence of events is critical for investigation of a suspicious event. As a Tomcat derivative, tc Server can be configured with an “AccessLogValve. A Valve element represents a component that can be inserted into the request processing pipeline. The pattern attribute of the “AccessLogValve” controls which data gets logged. The “%t” parameter specifies that the system time should be recorded.

Description

After a security incident has occurred, investigators will often review log files to determine when events occurred. Understanding the precise sequence of events is critical for investigation of a suspicious event. As a Tomcat derivative, tc Server can be configured with an “AccessLogValve. A Valve element represents a component that can be inserted into the request processing pipeline. The pattern attribute of the “AccessLogValve” controls which data gets logged. The “%t” parameter specifies that the system time should be recorded.

STIG	Date
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-88531r1_chk )
At the command prompt, execute the following command: tail /storage/log/vcops/log/product-ui/localhost_access_log.YYYY-MM-dd.txt Note: Substitute the actual date in the file name. If the time and date of events are not being recorded, this is a finding.

Fix Text (F-95581r1_fix)
Navigate to and open /usr/lib/vmware-vcops/tomcat-web-app/conf/server.xml. Navigate to and locate . Configure the node with the below. Note: The “AccessLogValve” should be configured as follows: directory="logs" pattern="%h %l %u %t "%r" %s %b" prefix="localhost_access_log." suffix=".txt"/>