STIGQter: STIG Summary: Apache Server 2.4 Windows Server Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Apr 2026:

The Apache web server must produce log records containing sufficient information to establish what type of events occurred.

DISA Rule

SV-214311r1192938_rule

Vulnerability Number

V-214311

Group Title

SRG-APP-000095-WSR-000056

Rule Version

AS24-W1-000090

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.

Weight

10

Fix Recommendation

Configure the "LogFormat" in the "httpd.conf" file to look like the following:

<IfModule log_config_module>
LogFormat "%a %A %h %H %l %m %s %t %u %U \"%{Referer}i\" " combined
</IfModule>

Restart the Apache service.

NOTE: The log format may use different variables based on environment; however, it should be verified that it produces the same end result of logged elements.

Check Contents

Items to be logged are as shown in this sample line in the <'INSTALL PATH'>\conf\httpd.conf file:

<IfModule log_config_module>
LogFormat "%a %A %h %H %l %m %s %t %u %U \"%{Referer}i\" " combined
</IfModule>

If the web server is not configured to capture the required audit events for all sites and virtual directories, this is a finding.

Vulnerability Number

V-214311

Documentable

False

Rule Version

AS24-W1-000090

Severity Override Guidance

Items to be logged are as shown in this sample line in the <'INSTALL PATH'>\conf\httpd.conf file:

<IfModule log_config_module>
LogFormat "%a %A %h %H %l %m %s %t %u %U \"%{Referer}i\" " combined
</IfModule>

If the web server is not configured to capture the required audit events for all sites and virtual directories, this is a finding.

Check Content Reference

M

Target Key

3998