Host must transmit audit records to a remote log collector

Cómo se verifica

Método de auditoría: Comando de shell

out=$(esxcli system settings advanced list -o /Syslog/global/logHost 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
[ -n "$v" ] || { echo 'Syslog.global.logHost is empty'; exit 1; }
out2=$(esxcli system settings advanced list -o /Syslog/global/auditRecord/remoteEnable 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out2" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Syslog/global/auditRecord/remoteEnable: no integer value'; exit 1 ;; esac
if [ "$v" -eq 1 ]; then echo compliant; else echo "/Syslog/global/auditRecord/remoteEnable = $v (expected true/1)"; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

To configure remote logging properly, perform the following from the vSphere web client: 1. Select the host 2. Click Configure then expand System then select Advanced System Settings. 3. Select Edit then enter Syslog.global.logHost in the filter. 4. Set the Syslog.global.logHost to the hostname or IP address of the central log server. 5. Click OK. Alternately, run the following PowerCLI command: # Set Syslog.global.logHost for each host Get-VMHost | Foreach { Set-AdvancedSetting -VMHost $_ -Name Syslog.global.logHost -Value "<NewLocation>" } Note: When setting a remote log host, it is also recommended to set the "Syslog.global.logDirUnique" to true.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target vmware