STIGQter: STIG Summary: VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

tc Server CaSa must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

DISA Rule

SV-99695r1_rule

Vulnerability Number

V-89045

Group Title

SRG-APP-000374-WSR-000172

Rule Version

VROM-TC-000805

Severity

CAT II

CCI(s)

• CCI-001890 - The information system records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

Weight

10

Fix Recommendation

Navigate to and open /usr/lib/vmware-casa/casa-webapp/conf/server.xml.

Navigate to the <Valve className="org.apache.catalina.valves.AccessLogValve"> node.

Set the “pattern” setting with "%h %l %u %t &quot;%r&quot; %s %b"

Note: The <Valve> node should be configured per the below:

<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
pattern="%h %l %u %t &quot;%r&quot; %s %b"
prefix="localhost_access_log."
suffix=".txt"/>

Check Contents

At the command prompt, execute the following command:

tail /storage/log/vcops/log/casa/localhost_access_log.YYYY-MM-dd.txt

If the timestamp does not contain a time zone mapping, this is a finding.

Note: Substitute the actual date in the file name.

Note: In Common Log Format, a timestamp will look like [06/Feb/2016:23:12:57 +0000]. The “+0000” part is the time zone mapping.

Vulnerability Number

V-89045

Documentable

False

Rule Version

VROM-TC-000805

Severity Override Guidance

At the command prompt, execute the following command:

tail /storage/log/vcops/log/casa/localhost_access_log.YYYY-MM-dd.txt

If the timestamp does not contain a time zone mapping, this is a finding.

Note: Substitute the actual date in the file name.

Note: In Common Log Format, a timestamp will look like [06/Feb/2016:23:12:57 +0000]. The “+0000” part is the time zone mapping.

Check Content Reference

M

Target Key

3441

Comments