3.3 Ensure remote logging is configured for ESXi hosts

Information

By default ESXI logs are stored on a local scratch volume or ramdisk. To preserve logs
further configure centralized logging for the ESXI hosts.

*Rationale*

Remote logging to a central log host provides a secure, centralized store for ESXi logs. You
can more easily monitor all hosts with a single tool. You can also do aggregate analysis and
searching to look for such things as coordinated attacks on multiple hosts. Logging to a
secure, centralized log server helps prevent log tampering and provides a long-term audit
record.

Solution

To configure remote logging properly, perform the following from the vSphere web client:

1. Select the host and click "Configure" -> "System" -> "Advanced System Settings".
2. Enter Syslog.global.logHost in the filter.
3. Make sure Syslog.global.logHost is highlighted, then click the pencil icon.
4. Set Syslog.global.logHost to the hostname or IP address of the central log server.
5. Click "OK".

Alternately, run the following PowerCLI command:

# Set Syslog.global.logHost for each host
Get-VMHost | Foreach { Set-<span>AdvancedSetting </span><span>-VMHost $_ - Name
Syslog.global.logHost -Value "<NewLocation>" }</span>

Note: When setting a remote log host, it is also recommended to set the
"Syslog.global.logDirUnique" to true. You must configure the syslog settings for each host.

See Also

https://workbench.cisecurity.org/files/2168

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: VMware

Control ID: 7116a830760f8b82f51a44d03b4d3cd03ee9657611b364eeaf493eeeee49447f