UCF STIG Viewer Logo

The vCenter server must be configured to send events to a central log server.


Overview

Finding ID Version Rule ID IA Controls Severity
V-258947 VCSA-80-000280 SV-258947r961395_rule Medium
Description
vCenter server generates volumes of security-relevant application-level events. Examples include logins, system reconfigurations, system degradation warnings, and more. To ensure these events are available for forensic analysis and correlation, they must be sent to the syslog and forwarded on to the configured Security Information and Event Management (SIEM) system and/or central log server. The vCenter server sends events to syslog by default, but this configuration must be verified and maintained.
STIG Date
VMware vSphere 8.0 vCenter Security Technical Implementation Guide 2024-07-11

Details

Check Text ( C-62687r934497_chk )
From the vSphere Client, go to Host and Clusters.

Select a vCenter Server >> Configure >> Settings >> Advanced Settings.

Verify that "vpxd.event.syslog.enabled" value is set to "true".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-AdvancedSetting -Entity -Name vpxd.event.syslog.enabled

If the "vpxd.event.syslog.enabled" value is not set to "true", this is a finding.
Fix Text (F-62596r934498_fix)
From the vSphere Client, go to Host and Clusters.

Select a vCenter Server >> Configure >> Settings >> Advanced Settings.

Click "Edit Settings" and configure the "vpxd.event.syslog.enabled" setting to "true".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-AdvancedSetting -Entity -Name vpxd.event.syslog.enabled | Set-AdvancedSetting -Value true