The ESXi host must produce audit records containing information to establish what type of events occurred.

Without establishing what types of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.

Satisfies: SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "Config.HostAgent.log.level" value and verify it is set to "info".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level

If the "Config.HostAgent.log.level" setting is not set to "info", this is a finding.

Note: Verbose logging level is acceptable for troubleshooting purposes.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings. Click "Edit".

Select the "Config.HostAgent.log.level" value and configure it to "info".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.log.level | Set-AdvancedSetting -Value "info"