Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.
On the VCSA, the 'vmware-vmon' service starts up the Java virtual machines (JVMs) for various vCenter processes, including Performance Charts, and the individual 'json' config files control the early JVM logging. Ensuring these 'json' files are configured correctly enables early Java 'stdout' and 'stderr' logging.
Satisfies: SRG-APP-000089-WSR-000047, SRG-APP-000092-WSR-000055
Navigate to and open /etc/vmware/vmware-vmon/svcCfgfiles/perfcharts.json.
Below the last line of the 'PreStartCommandArg' block, add the following line:
'StreamRedirectFile' : '%VMWARE_LOG_DIR%/vmware/perfcharts/vmware-perfcharts-runtime.log',
Restart the appliance for changes to take effect.
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.