UCF STIG Viewer Logo

The vCenter server must have task and event retention set to at least 30 days.


Overview

Finding ID Version Rule ID IA Controls Severity
V-258959 VCSA-80-000293 SV-258959r961863_rule Medium
Description
vCenter tasks and events contain valuable historical actions, useful in troubleshooting availability issues and for incident forensics. While vCenter events are sent to central log servers in real time, it is important that administrators have quick access to this information when needed. vCenter retains 30 days of tasks and events by default, and this is sufficient for most purposes. The vCenter disk partitions are also sized with this in mind. Decreasing is not recommended for operational reasons, while increasing is not recommended unless guided by VMware support due to the partition sizing concerns.
STIG Date
VMware vSphere 8.0 vCenter Security Technical Implementation Guide 2024-07-11

Details

Check Text ( C-62699r934533_chk )
From the vSphere Client, go to Host and Clusters.

Select a vCenter Server >> Configure >> Settings >> General.

Click to expand the "Database" section.

Note the "Task retention" and "Event retention" values.

If either value is configured to less than "30" days, this is a finding.
Fix Text (F-62608r934534_fix)
From the vSphere Client, go to Host and Clusters.

Select a vCenter Server >> Configure >> Settings >> General.

Click "Edit".

On the "Database" tab, set the value for both "Task retention" and "Event retention" to "30" days (default) or greater, as required by your site.

Click "Save".