VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide

The VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide (V1 R5) has 113 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

113STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R5

CurrentPublished Wed Sep 30 2026 What changed in V1R5

The Photon operating system must configure auditd to use the correct log format.

VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide

Assessment Title

Rule Text

The Photon operating system must configure auditd to use the correct log format.

Description

Discussion Text

To compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know exact, unfiltered details of the event in question.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-256488

Rule

SV-256488r958414_rule

Severity

medium

Rule Version

PHTN-30-000011

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

At the command line, run the following command:

# grep "^log_format" /etc/audit/auditd.conf

Expected result:

log_format = RAW

If there is no output, this is not a finding.

If the output does not match the expected result, this is a finding.

Implementation Procedure

Fix Text

Navigate to and open:

/etc/audit/auditd.conf

Ensure the "log_format" line is uncommented and set to the following:

log_format = RAW

At the command line, run the following command:

# killproc auditd -TERM
# systemctl start auditd

STIG check 11 of 113 in the VMware vSphere 7.0 vCenter Appliance Photon OS STIG checklist

← Previous · V-256487The Photon operating system must configure auditd to log to disk.Next · V-256489 →The Photon operating system must be configured to audit the execution of privileged functions.