STIGQter: STIG Summary: VMware vSphere 7.0 ESXi Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 02 Apr 2025:

The ESXi host must produce audit records containing information to establish what type of events occurred.

DISA Rule

SV-256396r958412_rule

Vulnerability Number

V-256396

Group Title

SRG-OS-000037-VMM-000150

Rule Version

ESXI-70-000030

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.

Weight

10

Fix Recommendation

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings. Click "Edit".

Select the "Config.HostAgent.log.level" value and configure it to "info".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level | Set-AdvancedSetting -Value "info"

Check Contents

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "Config.HostAgent.log.level" value and verify it is set to "info".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level

If the "Config.HostAgent.log.level" setting is not set to "info", this is a finding.

Note: Verbose logging level is acceptable for troubleshooting purposes.

Vulnerability Number

V-256396

Documentable

False

Rule Version

ESXI-70-000030

Severity Override Guidance

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "Config.HostAgent.log.level" value and verify it is set to "info".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level

If the "Config.HostAgent.log.level" setting is not set to "info", this is a finding.

Note: Verbose logging level is acceptable for troubleshooting purposes.

Check Content Reference

M

Target Key

5518