The NSX Manager must configure logging levels for services to ensure audit records are generated.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-265289 | SRG-APP-000027-NDM-000209 | NMGR-4X-000007 | SV-265289r994090_rule | 2024-12-13 | 1 |
Description
Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
Audit records can be generated from various components within the network device (e.g., module or policy filter).
Satisfies: SRG-APP-000027-NDM-000209, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321, SRG-APP-000505-NDM-000322, SRG-APP-000506-NDM-000323, SRG-APP-000516-NDM-000334
ℹ️ Check
From an NSX Manager shell, run the following commands:
> get service async_replicator | find Logging
> get service auth | find Logging
> get service http | find Logging
> get service manager | find Logging
> get service telemetry | find Logging
Expected result:
Logging level: info
If any service listed does not have logging level configured to "info", this is a finding.
✔️ Fix
From an NSX Manager shell, run the following commands:
> set service async_replicator logging-level info
> set service auth logging-level info
> set service http logging-level info
> set service manager logging-level info
> set service telemetry logging-level info