STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 01 Jul 2026:

The vCenter VAMI service must off-load log records onto a different system or media from the system being logged.

DISA Rule

SV-259142r1210449_rule

Vulnerability Number

V-259142

Group Title

SRG-APP-000125-WSR-000071

Rule Version

VCLD-80-000022

Severity

CAT II

CCI(s)

• CCI-001348 - Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component that the system or component being audited.
• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/vmware-syslog/vmware-services-applmgmt.conf

Create the file if it does not exist.

Set the contents of the file as follows:

#applmgmt.log
input(type="imfile"
File="/var/log/vmware/applmgmt/applmgmt.log"
Tag="applmgmt"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#applmgmt-audit.log
input(type="imfile"
File="/var/log/vmware/applmgmt-audit/applmgmt-audit.log"
Tag="applmgmt-audit"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#applmgmt-backup-restore-audit.log
input(type="imfile"
File="/var/log/vmware/applmgmt-audit/applmgmt-br-audit.log"
Tag="applmgmt-br-audit"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vami-access.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/access.log"
Tag="vami-access"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vami-error.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/error.log"
Tag="vami-error"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#dcui.log
input(type="imfile"
File="/var/log/vmware/applmgmt/dcui.log"
Tag="dcui"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#detwist.log
input(type="imfile"
File="/var/log/vmware/applmgmt/detwist.log"
Tag="detwist"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#firewall-reload.log
input(type="imfile"
File="/var/log/vmware/applmgmt/firewall-reload.log"
Tag="firewall-reload"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#applmgmt_vmonsvc.std*
input(type="imfile"
File="/var/log/vmware/applmgmt/applmgmt_vmonsvc.stdout"
Tag="applmgmt_vmonsvc"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
input(type="imfile"
File="/var/log/vmware/applmgmt/applmgmt_vmonsvc.stderr"
Tag="applmgmt_vmonsvc"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#backupSchedulerCron
input(type="imfile"
File="/var/log/vmware/applmgmt/backupSchedulerCron.log"
Tag="backupSchedulerCron"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#progress.log
input(type="imfile"
File="/var/log/vmware/applmgmt/progress.log"
Tag="progress"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#statsmoitor-alarms
input(type="imfile"
File="/var/log/vmware/statsmon/statsmoitor-alarms.log"
Tag="statsmoitor-alarms"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#StatsMonitor
input(type="imfile"
File="/var/log/vmware/statsmon/StatsMonitor.log"
Tag="StatsMonitor"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#StatsMonitorStartup.log.std*
input(type="imfile"
File="/var/log/vmware/statsmon/StatsMonitorStartup.log.std*"
Tag="StatsMonitor-Startup"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#PatchRunner
input(type="imfile"
File="/var/log/vmware/applmgmt/PatchRunner.log"
Tag="PatchRunner"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#update_microservice
input(type="imfile"
File="/var/log/vmware/applmgmt/update_microservice.log"
Tag="update_microservice"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vami
input(type="imfile"
File="/var/log/vmware/applmgmt/vami.log"
Tag="vami"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vcdb_pre_patch
input(type="imfile"
File="/var/log/vmware/applmgmt/vcdb_pre_patch.*"
Tag="vcdb_pre_patch"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#dnsmasq.log
input(type="imfile"
File="/var/log/vmware/dnsmasq.log"
Tag="dnsmasq"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#procstate
input(type="imfile"
File="/var/log/vmware/procstate"
Tag="procstate"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#backup.log
input(type="imfile"
File="/var/log/vmware/applmgmt/backup.log"
Tag="applmgmt-backup"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#size.log
input(type="imfile"
File="/var/log/vmware/applmgmt/size.log"
Tag="applmgmt-size"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#restore.log
input(type="imfile"
File="/var/log/vmware/applmgmt/restore.log"
Tag="applmgmt-restore"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#reconciliation.log
input(type="imfile"
File="/var/log/vmware/applmgmt/reconciliation.log"
Tag="applmgmt-reconciliation"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#pnid_change.log
input(type="imfile"
File="/var/log/vmware/applmgmt/pnid_change.log"
Tag="applmgmt-pnid-change"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Check Contents

By default, a vmware-services-applmgmt.conf rsyslog configuration file includes the service logs when syslog is configured on vCenter, but it must be verified.

At the command prompt, run the following command:

# cat /etc/vmware-syslog/vmware-services-applmgmt.conf

Expected result:

#applmgmt.log
input(type="imfile"
File="/var/log/vmware/applmgmt/applmgmt.log"
Tag="applmgmt"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#applmgmt-audit.log
input(type="imfile"
File="/var/log/vmware/applmgmt-audit/applmgmt-audit.log"
Tag="applmgmt-audit"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#applmgmt-backup-restore-audit.log
input(type="imfile"
File="/var/log/vmware/applmgmt-audit/applmgmt-br-audit.log"
Tag="applmgmt-br-audit"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vami-access.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/access.log"
Tag="vami-access"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vami-error.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/error.log"
Tag="vami-error"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#dcui.log
input(type="imfile"
File="/var/log/vmware/applmgmt/dcui.log"
Tag="dcui"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#detwist.log
input(type="imfile"
File="/var/log/vmware/applmgmt/detwist.log"
Tag="detwist"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#firewall-reload.log
input(type="imfile"
File="/var/log/vmware/applmgmt/firewall-reload.log"
Tag="firewall-reload"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#applmgmt_vmonsvc.std*
input(type="imfile"
File="/var/log/vmware/applmgmt/applmgmt_vmonsvc.stdout"
Tag="applmgmt_vmonsvc"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
input(type="imfile"
File="/var/log/vmware/applmgmt/applmgmt_vmonsvc.stderr"
Tag="applmgmt_vmonsvc"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#backupSchedulerCron
input(type="imfile"
File="/var/log/vmware/applmgmt/backupSchedulerCron.log"
Tag="backupSchedulerCron"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#progress.log
input(type="imfile"
File="/var/log/vmware/applmgmt/progress.log"
Tag="progress"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#statsmoitor-alarms
input(type="imfile"
File="/var/log/vmware/statsmon/statsmoitor-alarms.log"
Tag="statsmoitor-alarms"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#StatsMonitor
input(type="imfile"
File="/var/log/vmware/statsmon/StatsMonitor.log"
Tag="StatsMonitor"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#StatsMonitorStartup.log.std*
input(type="imfile"
File="/var/log/vmware/statsmon/StatsMonitorStartup.log.std*"
Tag="StatsMonitor-Startup"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#PatchRunner
input(type="imfile"
File="/var/log/vmware/applmgmt/PatchRunner.log"
Tag="PatchRunner"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#update_microservice
input(type="imfile"
File="/var/log/vmware/applmgmt/update_microservice.log"
Tag="update_microservice"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vami
input(type="imfile"
File="/var/log/vmware/applmgmt/vami.log"
Tag="vami"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vcdb_pre_patch
input(type="imfile"
File="/var/log/vmware/applmgmt/vcdb_pre_patch.*"
Tag="vcdb_pre_patch"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#dnsmasq.log
input(type="imfile"
File="/var/log/vmware/dnsmasq.log"
Tag="dnsmasq"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#procstate
input(type="imfile"
File="/var/log/vmware/procstate"
Tag="procstate"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#backup.log
input(type="imfile"
File="/var/log/vmware/applmgmt/backup.log"
Tag="applmgmt-backup"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#size.log
input(type="imfile"
File="/var/log/vmware/applmgmt/size.log"
Tag="applmgmt-size"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#restore.log
input(type="imfile"
File="/var/log/vmware/applmgmt/restore.log"
Tag="applmgmt-restore"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#reconciliation.log
input(type="imfile"
File="/var/log/vmware/applmgmt/reconciliation.log"
Tag="applmgmt-reconciliation"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#pnid_change.log
input(type="imfile"
File="/var/log/vmware/applmgmt/pnid_change.log"
Tag="applmgmt-pnid-change"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Note: If the entries for "deleteStateOnFileDelete" or "reopenOnTruncate" are not present, this is not a finding.

If the output does not match the expected result, this is a finding.

Vulnerability Number

V-259142

Documentable

False

Rule Version

VCLD-80-000022

Severity Override Guidance

By default, a vmware-services-applmgmt.conf rsyslog configuration file includes the service logs when syslog is configured on vCenter, but it must be verified.

At the command prompt, run the following command:

# cat /etc/vmware-syslog/vmware-services-applmgmt.conf

Expected result:

#applmgmt.log
input(type="imfile"
File="/var/log/vmware/applmgmt/applmgmt.log"
Tag="applmgmt"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#applmgmt-audit.log
input(type="imfile"
File="/var/log/vmware/applmgmt-audit/applmgmt-audit.log"
Tag="applmgmt-audit"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#applmgmt-backup-restore-audit.log
input(type="imfile"
File="/var/log/vmware/applmgmt-audit/applmgmt-br-audit.log"
Tag="applmgmt-br-audit"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vami-access.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/access.log"
Tag="vami-access"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vami-error.log
input(type="imfile"
File="/opt/vmware/var/log/lighttpd/error.log"
Tag="vami-error"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#dcui.log
input(type="imfile"
File="/var/log/vmware/applmgmt/dcui.log"
Tag="dcui"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#detwist.log
input(type="imfile"
File="/var/log/vmware/applmgmt/detwist.log"
Tag="detwist"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#firewall-reload.log
input(type="imfile"
File="/var/log/vmware/applmgmt/firewall-reload.log"
Tag="firewall-reload"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#applmgmt_vmonsvc.std*
input(type="imfile"
File="/var/log/vmware/applmgmt/applmgmt_vmonsvc.stdout"
Tag="applmgmt_vmonsvc"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
input(type="imfile"
File="/var/log/vmware/applmgmt/applmgmt_vmonsvc.stderr"
Tag="applmgmt_vmonsvc"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#backupSchedulerCron
input(type="imfile"
File="/var/log/vmware/applmgmt/backupSchedulerCron.log"
Tag="backupSchedulerCron"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#progress.log
input(type="imfile"
File="/var/log/vmware/applmgmt/progress.log"
Tag="progress"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#statsmoitor-alarms
input(type="imfile"
File="/var/log/vmware/statsmon/statsmoitor-alarms.log"
Tag="statsmoitor-alarms"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#StatsMonitor
input(type="imfile"
File="/var/log/vmware/statsmon/StatsMonitor.log"
Tag="StatsMonitor"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#StatsMonitorStartup.log.std*
input(type="imfile"
File="/var/log/vmware/statsmon/StatsMonitorStartup.log.std*"
Tag="StatsMonitor-Startup"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#PatchRunner
input(type="imfile"
File="/var/log/vmware/applmgmt/PatchRunner.log"
Tag="PatchRunner"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#update_microservice
input(type="imfile"
File="/var/log/vmware/applmgmt/update_microservice.log"
Tag="update_microservice"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vami
input(type="imfile"
File="/var/log/vmware/applmgmt/vami.log"
Tag="vami"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#vcdb_pre_patch
input(type="imfile"
File="/var/log/vmware/applmgmt/vcdb_pre_patch.*"
Tag="vcdb_pre_patch"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#dnsmasq.log
input(type="imfile"
File="/var/log/vmware/dnsmasq.log"
Tag="dnsmasq"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#procstate
input(type="imfile"
File="/var/log/vmware/procstate"
Tag="procstate"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#backup.log
input(type="imfile"
File="/var/log/vmware/applmgmt/backup.log"
Tag="applmgmt-backup"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#size.log
input(type="imfile"
File="/var/log/vmware/applmgmt/size.log"
Tag="applmgmt-size"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#restore.log
input(type="imfile"
File="/var/log/vmware/applmgmt/restore.log"
Tag="applmgmt-restore"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#reconciliation.log
input(type="imfile"
File="/var/log/vmware/applmgmt/reconciliation.log"
Tag="applmgmt-reconciliation"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
#pnid_change.log
input(type="imfile"
File="/var/log/vmware/applmgmt/pnid_change.log"
Tag="applmgmt-pnid-change"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Note: If the entries for "deleteStateOnFileDelete" or "reopenOnTruncate" are not present, this is not a finding.

If the output does not match the expected result, this is a finding.

Check Content Reference

M

Target Key

5571