3.2 Ensure persistent logging is configured for all ESXi hosts

Information

ESXi can be configured to store log files on an in-memory file system. This occurs when the
host's Syslog.global.LogDir property is set to a non-persistent location, such as
/scratch. When this is done, only a single day's worth of logs are stored at any time.
Additionally, log files will be reinitialized upon each reboot.


*Rationale*

Non-persistent logging presents a security risk because user activity logged on the host is
only stored temporarily and will not be preserved across reboots. This can also complicate
auditing and make it harder to monitor events and diagnose issues. ESXi host logging should
always be configured to a persistent datastore.

Solution

To configure persistent logging properly, perform the following from the vSphere web client:

1. Select the host and go to "Configure" -> "System" -> "Advanced System Settings".
2. Enter Syslog.global.LogDir in the filter.
3. Set the Syslog.global.LogDirto the desired datastore path. Note: additional disk
space may be required to store the log files.
4. Make sure the attribute is highlighted, then click the pencil icon.

Alternatively, run the following PowerCLI command:

# Set Syslog.global.logDir for each host
Get-VMHost | Foreach { Set-AdvancedConfiguration -VMHost $_ -Name
Syslog.global.logDir -Value "<NewLocation>" }

See Also

https://workbench.cisecurity.org/files/2168

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: VMware

Control ID: 63e51c7488c3dd92e382efae56b46bf43b5ae90899b20d34b3ef2ca980368b1c