GEN003510-ESXI5-006660 - Kernel core dumps must be disabled unless needed

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

Information

Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space and may result in Denial-of-Service by exhausting the available space on the target file system. The kernel core dump process may increase the amount of time a system is unavailable due to a crash. Kernel core dumps can be useful for kernel debugging.

Solution

For ESXi 5.0 servers (standalone or managed by vCenter Server) that have kernel core dumps configured locally:
To create a diagnostic coredump partition on disk, select a storage device with at least 100MB of free space (200MB recommended) that is accessible by the ESXi host. Ensure the storage device you intend to use does not contain any useful data as it will be overwritten. Use the partedUtil command line utility (refer to the vendor's documentation) to create a new partition. Then use the esxcli command line utility to list all accessible diagnostic partitions.
# esxcli system coredump partition list

The output appears similar to:
Name Path Active Configured
---------------------------------- ------ --------- ----------------
mpx.vmhba2:C0:T0:L0:7 /vmfs/devices/... false false

Configure and activate one of the accessible diagnostic partitions using the esxcli command line utility.
# esxcli system coredump partition set --partition='Partition_Name'
# esxcli system coredump partition set --enable true

Validate that the diagnostic partition is now active using the command:
# esxcli system coredump partition list

The output should now appear similar to:
Name Path Active Configured
---------------------------------- ------ --------- ----------------
mpx.vmhba2:C0:T0:L0:7 /vmfs/devices/... true true

For ESXi 5.0 servers managed by vCenter Server using a network core dump server:
View the current network configuration.
# esxcli system coredump network get

Specify the VMkernel network interface to use for outbound traffic and the IP address/UDP port number of the remote network coredump server.
# esxcli system coredump network set --interface-name <VMkernelInterface> --server-ipv4 <IPAddress> --server-port PortNumber

Enable the above selected network coredump configuration.
# esxcli system coredump network set --enable true

Confirm the configuration.
# esxcli system coredump network get

Item Details

Audit Name: DISA STIG VMWare ESXi Server 5 STIG v1r10

Plugin: VMware

Control ID: e21b3cda7424880c86c1d2cb24b58f74d6b3af47cbf13e69c6d8ddf8b856d352

Detections

Analytics

GEN003510-ESXI5-006660 - Kernel core dumps must be disabled unless needed

Warning! Audit Deprecated

Information

Solution

See Also

Item Details