Host must deactivate log filtering

MediaNivel 1Automatizadavmware

Descripción

Log filtering can be employed to diminish the frequency of repetitive log entries and to preclude specific log events entirely. By employing the Syslog.global.logFilters configuration parameter, one can stipulate filtering criteria, which when met, will cause the designated log events to be excluded from the system logs. The audit reads Syslog.global.logFiltersEnable with esxcli and requires false (0). Runs in the ESXi Shell (busybox sh) as root.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(esxcli system settings advanced list -o /Syslog/global/logFiltersEnable 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Syslog/global/logFiltersEnable: no integer value'; exit 1 ;; esac
if [ "$v" -eq 0 ]; then echo compliant; else echo "/Syslog/global/logFiltersEnable = $v (expected false/0)"; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Disable log filtering 2. execute command: esxcli system syslog config logfilter set -- log-filtering-enabled=false 3. execute: Get-VMHost | Get-AdvancedSetting -Name "Syslog.global.logFiltersEnable" passing value is: False

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: vmwareesxilogging
Referencia: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 4.5 Host must deactivate log filtering

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target vmware