VCRP-67-000006 - The rhttpproxy must have logging enabled.

Information

After a security incident has occurred, investigators will often review log files to determine what happened. The rhttpproxy must create logs upon service startup to capture information relevant to investigations.

Solution

Navigate to and open /etc/vmware-rhttpproxy/config.xml.

Locate the <config>/<log> block and configure <outputToFiles> as follows:

<outputToFiles>true</outputToFiles>

Restart the service for changes to take effect.

# vmon-cli --restart rhttpproxy

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-14(1), CAT|II, CCI|CCI-001464, Rule-ID|SV-240721r879562_rule, STIG-ID|VCRP-67-000006, Vuln-ID|V-240721

Plugin: Unix

Control ID: 2d0307231d8c5b8ac538c15035ec3f17ad60ed67b959ee546c652398f0d8fa71