Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The ESXi host must configure a persistent log location for all locally stored logs.
Description
Discussion Text
ESXi can be configured to store log files on an in-memory file system. This occurs when the host's "/scratch" directory is linked to "/tmp/scratch". When this is done, only a single day's worth of logs are stored at any time. In addition, log files will be reinitialized upon each reboot.
This presents a security risk as user activity logged on the host is only stored temporarily and will not persist across reboots. This can also complicate auditing and make it harder to monitor events and diagnose issues. ESXi host logging should always be configured to a persistent datastore.
Note: Scratch space is configured automatically during installation or first boot of an ESXi host and does not usually need to be configured manually.
If ESXi is installed on an SD card or USB device, a persistent log location may not be configured upon install as normal.
This presents a security risk as user activity logged on the host is only stored temporarily and will not persist across reboots. This can also complicate auditing and make it harder to monitor events and diagnose issues. ESXi host logging should always be configured to a persistent datastore.
Note: Scratch space is configured automatically during installation or first boot of an ESXi host and does not usually need to be configured manually.
If ESXi is installed on an SD card or USB device, a persistent log location may not be configured upon install as normal.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.