UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The vCenter UI service must initiate session logging upon startup.


Overview

Finding ID Version Rule ID IA Controls Severity
V-259106 VCUI-80-000013 SV-259106r960888_rule Medium
Description
Logging must be started as soon as possible when a service starts and as late as possible when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.
STIG Date
VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide 2024-07-11

Details

Check Text ( C-62846r935220_chk )
At the command prompt, run the following command:

# grep StreamRedirectFile /etc/vmware/vmware-vmon/svcCfgfiles/vsphere-ui.json

Expected output:

"StreamRedirectFile" : "%VMWARE_LOG_DIR%/vmware/vsphere-ui/logs/vsphere-ui-runtime.log",

If no log file is specified for the "StreamRedirectFile" setting, this is a finding.
Fix Text (F-62755r935221_fix)
Navigate to and open:

/etc/vmware/vmware-vmon/svcCfgfiles/vsphere-ui.json

Below the last line of the "PreStartCommandArg" block, add the following line:

"StreamRedirectFile" : "%VMWARE_LOG_DIR%/vmware/vsphere-ui/logs/vsphere-ui-runtime.log",

Restart the service with the following command:

# vmon-cli --restart vsphere-ui