The ESXi host must enable a persistent log location for all locally stored logs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239300	ESXI-67-000045	SV-239300r674829_rule		Medium

Description
ESXi can be configured to store log files on an in-memory file system. This occurs when the host's "/scratch" directory is linked to "/tmp/scratch". When this is done, only a single day's worth of logs is stored at any time. In addition, log files will be reinitialized upon each reboot. This presents a security risk as user activity logged on the host is only stored temporarily and will not persist across reboots. This can also complicate auditing and make it harder to monitor events and diagnose issues. ESXi host logging should always be configured to a persistent datastore. Note: Scratch space is configured automatically during installation or first boot of an ESXi host and does not usually need to be manually configured. ESXi Installable creates a 4 GB Fat16 partition on the target device during installation if there is sufficient space and if the device is considered "local". If ESXi is installed on an SD card or USB device, a persistent log location may not be configured upon install as normal.

Description

ESXi can be configured to store log files on an in-memory file system. This occurs when the host's "/scratch" directory is linked to "/tmp/scratch". When this is done, only a single day's worth of logs is stored at any time. In addition, log files will be reinitialized upon each reboot. This presents a security risk as user activity logged on the host is only stored temporarily and will not persist across reboots. This can also complicate auditing and make it harder to monitor events and diagnose issues. ESXi host logging should always be configured to a persistent datastore. Note: Scratch space is configured automatically during installation or first boot of an ESXi host and does not usually need to be manually configured. ESXi Installable creates a 4 GB Fat16 partition on the target device during installation if there is sufficient space and if the device is considered "local". If ESXi is installed on an SD card or USB device, a persistent log location may not be configured upon install as normal.

STIG	Date
VMware vSphere 6.7 ESXi Security Technical Implementation Guide	2022-01-05

Details

Check Text ( C-42533r674827_chk )
From the vSphere Client, select the ESXi host and go to Configure >> System >> Advanced System Settings. Select the "Syslog.global.logDir" value and verify it is set to a persistent location. or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $esxcli.system.syslog.config.get.Invoke() \| Select LocalLogOutput,LocalLogOutputIsPersistent If the "LocalLogOutputIsPersistent" value is not true, this is a finding.

Check Text ( C-42533r674827_chk )

From the vSphere Client, select the ESXi host and go to Configure >> System >> Advanced System Settings.

Select the "Syslog.global.logDir" value and verify it is set to a persistent location.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.syslog.config.get.Invoke() | Select LocalLogOutput,LocalLogOutputIsPersistent

If the "LocalLogOutputIsPersistent" value is not true, this is a finding.

Fix Text (F-42492r674828_fix)
From the vSphere Client, select the ESXi host and go to Configure >> System >> Advanced System Settings. Click "Edit" and select the "Syslog.global.logDir" value and set it to a known persistent location. or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: Get-VMHost \| Get-AdvancedSetting -Name Syslog.global.logDir \| Set-AdvancedSetting -Value "New Log Location"

Fix Text (F-42492r674828_fix)

From the vSphere Client, select the ESXi host and go to Configure >> System >> Advanced System Settings.

Click "Edit" and select the "Syslog.global.logDir" value and set it to a known persistent location.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logDir | Set-AdvancedSetting -Value "New Log Location"