vSphere Client must generate log records during Java startup and shutdown.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239752	VCFL-67-000010	SV-239752r679483_rule		Medium

Description
Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged. On the VCSA, the vmware-vmon service starts up the JVMs for various vCenter processes, including vSphere Client, and the individual json config files control the early jvm logging. Ensuring these json files are configured correctly enables early Java stdout and stderr logging.

Description

Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged. On the VCSA, the vmware-vmon service starts up the JVMs for various vCenter processes, including vSphere Client, and the individual json config files control the early jvm logging. Ensuring these json files are configured correctly enables early Java stdout and stderr logging.

STIG	Date
VMware vSphere 6.7 Virgo-Client Security Technical Implementation Guide	2021-03-18

Details

Check Text ( C-42985r679481_chk )
At the command prompt, execute the following command: # grep StreamRedirectFile /etc/vmware/vmware-vmon/svcCfgfiles/vsphere-client.json Expected result: "StreamRedirectFile": "%VMWARE_LOG_DIR%/vmware/vsphere-client/logs/vsphere-client-runtime.log", If there is no log file specified for the "StreamRedirectFile" setting, this is a finding.

Fix Text (F-42944r679482_fix)
Navigate to and open /etc/vmware/vmware-vmon/svcCfgfiles/vsphere-client.json. Below the last line of the "PreStartCommandArg" block, add the following line: "StreamRedirectFile": "%VMWARE_LOG_DIR%/vmware/vsphere-client/logs/vsphere-client-runtime.log", Restart the appliance for changes to take effect.