Host must configure a persistent log location for all locally stored system logs

Cómo se verifica

Método de auditoría: Comando de shell

out=$(esxcli system syslog config get 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk -F': *' 'tolower($1) ~ /^ *local log output is persistent$/ {print $2; exit}' | tr 'A-Z' 'a-z' | sed 's/ *$//')
if [ "$v" = true ]; then echo compliant; else echo "Local Log Output Is Persistent: ${v:-not reported}"; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

To configure persistent logging properly, perform the following from the vSphere web client: 1. Select the host 2. Click Configure then expand System then select Advanced System Settings. 3. Select Edit then enter Syslog.global.LogDir in the filter. 4. Set Syslog.global.logDir to a persistent location specified as [datastorename] path_to_file where the path is relative to the datastore. For example, [datastore1] /systemlogs. 5. Click OK. Alternatively, run the following PowerCLI command: # Set Syslog.global.logDir for each host Get-VMHost | Foreach { Set-AdvancedConfiguration -VMHost $_ -Name Syslog.global.logDir -Value "<NewLocation>" }

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target vmware