STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

The WebSphere Liberty Server must be configured to offload logs to a centralized system.

DISA Rule

SV-250327r1043188_rule

Vulnerability Number

V-250327

Group Title

SRG-APP-000109-AS-000070

Rule Version

IBMW-LS-000230

Severity

CAT II

CCI(s)

• CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.
• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

To send Liberty logs to a centralized syslog system, the Elastic environment must be set up as per the ELK stack/Elasticsearch directions. Once that is completed, configure the server.xml. The following is a sample configuration. Individual keystore, truststore, and authentication settings will vary. The SME must substitute their own values as needed.

The message, audit, and accessLog sources must be included at a minimum.

For additional information refer to the IBM website:
https://www.ibm.com/support/knowledgecenter/SSEQTP_liberty/com.ibm.WebSphere.wlp.doc/ae/twlp_analytics_logstash.html

EXAMPLE:

<featureManager>
<feature>logstashCollector-1.0</feature>
</featureManager>

<keyStore id="defaultKeyStore" password="xxxxxxx" />
<keyStore id="defaultTrustStore" location="trust.jks" password="xxxxxxx" />
<ssl id="myTLSConfig" trustStoreRef="defaultTrustStore" keyStoreRef="defaultKeyStore" />

<logstashCollector
source="message,accessLog,audit"
hostName="your ELK stack server"
port="Your ELK stack port"
sslRef="myTLSConfig">
</logstashCollector>

Check Contents

As a privileged user with local file access to ${server.config.dir}/server.xml, verify the logstashCollector-1.0 feature is enabled.

grep -i -A5 logstashcollector server.xml

EXAMPLE:
<featureManager>
<feature>logstashCollector-1.0</feature>
</featureManager>

<logstashCollector source="message,accessLog,audit"
hostName="<ip address of logstash server>"
port="<port of logstash server>"
sslRef="DefaultTLSSettings"
</logstashCollector>

If "logstashCollector" is not a configured feature and the logstashCollector "source" setting does not contain "message,accessLog,audit", this is a finding.

Vulnerability Number

V-250327

Documentable

False

Rule Version

IBMW-LS-000230

Severity Override Guidance

As a privileged user with local file access to ${server.config.dir}/server.xml, verify the logstashCollector-1.0 feature is enabled.

grep -i -A5 logstashcollector server.xml

EXAMPLE:
<featureManager>
<feature>logstashCollector-1.0</feature>
</featureManager>

<logstashCollector source="message,accessLog,audit"
hostName="<ip address of logstash server>"
port="<port of logstash server>"
sslRef="DefaultTLSSettings"
</logstashCollector>

If "logstashCollector" is not a configured feature and the logstashCollector "source" setting does not contain "message,accessLog,audit", this is a finding.

Check Content Reference

M

Target Key

5424