Host must configure a persistent log location for all locally stored system logs

보통레벨 1자동vmware

설명

Configure the Syslog.global.logDir parameter to specify a persistent directory for system logs, ensuring they are retained across reboots. This can be set to a directory on mounted NFS or VMFS volumes, other than the default which is an in-memory filesystem that retains only a single day's worth of logs. The audit runs esxcli system syslog config get and requires "Local Log Output Is Persistent: true". Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

out=$(esxcli system syslog config get 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk -F': *' 'tolower($1) ~ /^ *local log output is persistent$/ {print $2; exit}' | tr 'A-Z' 'a-z' | sed 's/ *$//')
if [ "$v" = true ]; then echo compliant; else echo "Local Log Output Is Persistent: ${v:-not reported}"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To configure persistent logging properly, perform the following from the vSphere web client: 1. Select the host 2. Click Configure then expand System then select Advanced System Settings. 3. Select Edit then enter Syslog.global.LogDir in the filter. 4. Set Syslog.global.logDir to a persistent location specified as [datastorename] path_to_file where the path is relative to the datastore. For example, [datastore1] /systemlogs. 5. Click OK. Alternatively, run the following PowerCLI command: # Set Syslog.global.logDir for each host Get-VMHost | Foreach { Set-AdvancedConfiguration -VMHost $_ -Name Syslog.global.logDir -Value "<NewLocation>" }

속성

운영 체제: 모두
태그: vmwareesxilogging
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 4.1 Host must configure a persistent log location for all locally stored system logs

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware