Host must transmit audit records to a remote log collector

Cara pemeriksaan

Metode audit: Perintah shell

out=$(esxcli system settings advanced list -o /Syslog/global/logHost 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
[ -n "$v" ] || { echo 'Syslog.global.logHost is empty'; exit 1; }
out2=$(esxcli system settings advanced list -o /Syslog/global/auditRecord/remoteEnable 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out2" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Syslog/global/auditRecord/remoteEnable: no integer value'; exit 1 ;; esac
if [ "$v" -eq 1 ]; then echo compliant; else echo "/Syslog/global/auditRecord/remoteEnable = $v (expected true/1)"; fi

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To configure remote logging properly, perform the following from the vSphere web client: 1. Select the host 2. Click Configure then expand System then select Advanced System Settings. 3. Select Edit then enter Syslog.global.logHost in the filter. 4. Set the Syslog.global.logHost to the hostname or IP address of the central log server. 5. Click OK. Alternately, run the following PowerCLI command: # Set Syslog.global.logHost for each host Get-VMHost | Foreach { Set-AdvancedSetting -VMHost $_ -Name Syslog.global.logHost -Value "<NewLocation>" } Note: When setting a remote log host, it is also recommended to set the "Syslog.global.logDirUnique" to true.

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target vmware