7.3 Ensure className is set correctly in context.xml

Information

Ensure the className attribute is set to AccessLogValve. The className attribute determines the access log valve to be used for logging.

Rationale:

Some log valves are not suited for production and should not be used. Apache recommends org.apache.catalina.valves.AccessLogValve

Solution

Add the following statement into the $CATALINA_BASE/webapps/<app_name>/META-INF/context.xml file if it does not already exist.

<Valve
className='org.apache.catalina.valves.AccessLogValve'
directory='$CATALINA_HOME/logs/'
prefix='access_log'
fileDateFormat='yyyy-MM-dd.HH'
suffix='.log'
pattern='%h %t %H cookie:%{SESSIONID}c request:%{SESSIONID}r %m %U %s %q %r'
/>

Default Value:

Does not exist by default.

See Also

https://workbench.cisecurity.org/files/4107

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: Unix

Control ID: 958584d4fab75e6adb66c3b8dd96c29adc62ac08fa4100b2f140e92c228db843