Host must transmit audit records to a remote log collector

점검 방법

감사 방식: 셸 명령

out=$(esxcli system settings advanced list -o /Syslog/global/logHost 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
[ -n "$v" ] || { echo 'Syslog.global.logHost is empty'; exit 1; }
out2=$(esxcli system settings advanced list -o /Syslog/global/auditRecord/remoteEnable 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out2" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Syslog/global/auditRecord/remoteEnable: no integer value'; exit 1 ;; esac
if [ "$v" -eq 1 ]; then echo compliant; else echo "/Syslog/global/auditRecord/remoteEnable = $v (expected true/1)"; fi

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To configure remote logging properly, perform the following from the vSphere web client: 1. Select the host 2. Click Configure then expand System then select Advanced System Settings. 3. Select Edit then enter Syslog.global.logHost in the filter. 4. Set the Syslog.global.logHost to the hostname or IP address of the central log server. 5. Click OK. Alternately, run the following PowerCLI command: # Set Syslog.global.logHost for each host Get-VMHost | Foreach { Set-AdvancedSetting -VMHost $_ -Name Syslog.global.logHost -Value "<NewLocation>" } Note: When setting a remote log host, it is also recommended to set the "Syslog.global.logDirUnique" to true.

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target vmware