OpenControls Logo

STIG Viewer

STIGViewer Support

The vCenter server must be configured to send events to a central log server.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258947VCSA-80-000280SV-258947r961395_ruleCCI-001851medium
Description
vCenter server generates volumes of security-relevant application-level events. Examples include logins, system reconfigurations, system degradation warnings, and more. To ensure these events are available for forensic analysis and correlation, they must be sent to the syslog and forwarded on to the configured Security Information and Event Management (SIEM) system and/or central log server. The vCenter server sends events to syslog by default, but this configuration must be verified and maintained.
STIGDate
VMware vSphere 8.0 vCenter Security Technical Implementation Guide2025-06-09

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-08.1Event Log Backup on Separate Physical Systems / Components
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (34) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-12(1)System-wide and Time-correlated Audit Trail
1.00
AU-12(3)Changes by Authorized Individuals
1.00
AU-14(1)System Start-up
1.00

+24 more (top 10 by confidence shown)

CCI1 mapping
CCI-001851
1.00

Details

Check Text (C-258947r961395_chk)

From the vSphere Client, go to Host and Clusters. Select a vCenter Server >> Configure >> Settings >> Advanced Settings. Verify that "vpxd.event.syslog.enabled" value is set to "true". or From a PowerCLI command prompt while connected to the vCenter server, run the following command: Get-AdvancedSetting -Entity <vcenter server name> -Name vpxd.event.syslog.enabled If the "vpxd.event.syslog.enabled" value is not set to "true", this is a finding.

Fix Text (F-62596r934498_fix)

From the vSphere Client, go to Host and Clusters. Select a vCenter Server >> Configure >> Settings >> Advanced Settings. Click "Edit Settings" and configure the "vpxd.event.syslog.enabled" setting to "true". or From a PowerCLI command prompt while connected to the vCenter server, run the following command: Get-AdvancedSetting -Entity <vcenter server name> -Name vpxd.event.syslog.enabled | Set-AdvancedSetting -Value true