STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 01 Jul 2026:

The vCenter UI service must off-load log records onto a different system or media from the system being logged.

DISA Rule

SV-259117r1210442_rule

Vulnerability Number

V-259117

Group Title

SRG-APP-000358-AS-000064

Rule Version

VCUI-80-000081

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Navigate to and open:

vmware-services-vsphere-ui.conf

Create the file if it does not exist.

Set the contents of the file as follows:

#vsphere-ui main log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log"
Tag="ui-main"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui change log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/changelog.log"
Tag="ui-changelog"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui dataservice log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/dataservice.log"
Tag="ui-dataservice"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui apigw log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/apigw.log"
Tag="ui-apigw"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui equinox log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/equinox.log"
Tag="ui-equinox"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui event log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/eventlog.log"
Tag="ui-eventlog"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui op id log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/opId.log"
Tag="ui-opid"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui performance audit log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/performanceAudit.log"
Tag="ui-performanceAudit"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui plugin-medic log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/plugin-medic.log"
Tag="ui-plugin-medic"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui threadmonitor log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/threadmonitor.log"
Tag="ui-threadmonitor"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui threadpools log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/threadpools.log"
Tag="ui-threadpools"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui vspheremessaging log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vspheremessaging.log"
Tag="ui-vspheremessaging"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui rpm log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere-ui-rpm.log"
Tag="ui-rpm"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui runtime log stdout
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere-ui-runtime.log.stdout"
Tag="ui-runtime-stdout"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui runtime log stderr
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere-ui-runtime.log.stderr"
Tag="ui-runtime-stderr"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui access log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/access/localhost_access_log.txt"
Tag="ui-access"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui gc log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/vsphere-ui-gc.log"
Tag="ui-gc"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui firstboot log
input(type="imfile"
File="/var/log/firstboot/vsphere_ui_firstboot*"
Tag="ui-firstboot"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui catalina
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/catalina.*.log"
Tag="ui-runtime-catalina"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui endpoint
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/endpoint.log"
Tag="ui-runtime-endpoint"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui localhost
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/localhost.*.log"
Tag="ui-runtime-localhost"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui vsan
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsan-plugin.log"
Tag="ui-runtime-vsan"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Check Contents

By default, a vmware-services-vsphere-ui.conf rsyslog configuration file includes the service logs when syslog is configured on vCenter, but it must be verified.

At the command prompt, run the following command:

# cat /etc/vmware-syslog/vmware-services-vsphere-ui.conf

Expected result:

#vsphere-ui main log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log"
Tag="ui-main"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui change log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/changelog.log"
Tag="ui-changelog"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui dataservice log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/dataservice.log"
Tag="ui-dataservice"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui apigw log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/apigw.log"
Tag="ui-apigw"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui equinox log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/equinox.log"
Tag="ui-equinox"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui event log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/eventlog.log"
Tag="ui-eventlog"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui op id log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/opId.log"
Tag="ui-opid"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui performance audit log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/performanceAudit.log"
Tag="ui-performanceAudit"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui plugin-medic log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/plugin-medic.log"
Tag="ui-plugin-medic"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui threadmonitor log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/threadmonitor.log"
Tag="ui-threadmonitor"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui threadpools log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/threadpools.log"
Tag="ui-threadpools"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui vspheremessaging log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vspheremessaging.log"
Tag="ui-vspheremessaging"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui rpm log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere-ui-rpm.log"
Tag="ui-rpm"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui runtime log stdout
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere-ui-runtime.log.stdout"
Tag="ui-runtime-stdout"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui runtime log stderr
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere-ui-runtime.log.stderr"
Tag="ui-runtime-stderr"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui access log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/access/localhost_access_log.txt"
Tag="ui-access"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui gc log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/vsphere-ui-gc.log"
Tag="ui-gc"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui firstboot log
input(type="imfile"
File="/var/log/firstboot/vsphere_ui_firstboot*"
Tag="ui-firstboot"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui catalina
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/catalina.*.log"
Tag="ui-runtime-catalina"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui endpoint
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/endpoint.log"
Tag="ui-runtime-endpoint"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui localhost
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/localhost.*.log"
Tag="ui-runtime-localhost"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui vsan
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsan-plugin.log"
Tag="ui-runtime-vsan"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Note: If the entries for "deleteStateOnFileDelete" or "reopenOnTruncate" are not present, this is not a finding.

If the output does not match the expected result, this is a finding.

Vulnerability Number

V-259117

Documentable

False

Rule Version

VCUI-80-000081

Severity Override Guidance

By default, a vmware-services-vsphere-ui.conf rsyslog configuration file includes the service logs when syslog is configured on vCenter, but it must be verified.

At the command prompt, run the following command:

# cat /etc/vmware-syslog/vmware-services-vsphere-ui.conf

Expected result:

#vsphere-ui main log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log"
Tag="ui-main"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui change log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/changelog.log"
Tag="ui-changelog"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui dataservice log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/dataservice.log"
Tag="ui-dataservice"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui apigw log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/apigw.log"
Tag="ui-apigw"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui equinox log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/equinox.log"
Tag="ui-equinox"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui event log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/eventlog.log"
Tag="ui-eventlog"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui op id log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/opId.log"
Tag="ui-opid"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui performance audit log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/performanceAudit.log"
Tag="ui-performanceAudit"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui plugin-medic log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/plugin-medic.log"
Tag="ui-plugin-medic"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui threadmonitor log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/threadmonitor.log"
Tag="ui-threadmonitor"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui threadpools log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/threadpools.log"
Tag="ui-threadpools"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui vspheremessaging log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vspheremessaging.log"
Tag="ui-vspheremessaging"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui rpm log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere-ui-rpm.log"
Tag="ui-rpm"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui runtime log stdout
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere-ui-runtime.log.stdout"
Tag="ui-runtime-stdout"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui runtime log stderr
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsphere-ui-runtime.log.stderr"
Tag="ui-runtime-stderr"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui access log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/access/localhost_access_log.txt"
Tag="ui-access"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui gc log
input(type="imfile"
File="/var/log/vmware/vsphere-ui/vsphere-ui-gc.log"
Tag="ui-gc"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui firstboot log
input(type="imfile"
File="/var/log/firstboot/vsphere_ui_firstboot*"
Tag="ui-firstboot"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui catalina
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/catalina.*.log"
Tag="ui-runtime-catalina"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui endpoint
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/endpoint.log"
Tag="ui-runtime-endpoint"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui localhost
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/localhost.*.log"
Tag="ui-runtime-localhost"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vsphere-ui vsan
input(type="imfile"
File="/var/log/vmware/vsphere-ui/logs/vsan-plugin.log"
Tag="ui-runtime-vsan"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Note: If the entries for "deleteStateOnFileDelete" or "reopenOnTruncate" are not present, this is not a finding.

If the output does not match the expected result, this is a finding.

Check Content Reference

M

Target Key

5568