Lookup Service log files must be offloaded to a central log server in real time.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-256733	SRG-APP-000358-WSR-000163	VCLU-70-000028	SV-256733r888790_rule	2023-06-15	1

Description
Lookup Service produces several logs that must be offloaded from the originating system. This information can then be used for diagnostic, forensics, or other purposes relevant to ensuring the availability and integrity of the hosted application. Satisfies: SRG-APP-000358-WSR-000163, SRG-APP-000108-WSR-000166, SRG-APP-000125-WSR-000071

ℹ️ Check
At the command prompt, run the following command: # rpm -V VMware-visl-integration\|grep vmware-services-lookupsvc.conf If the above command returns any output, this is a finding.

✔️ Fix
Navigate to and open: /etc/vmware-syslog/vmware-services-lookupsvc.conf Create the file if it does not exist. Set the contents of the file as follows: #localhost_access_log input(type="imfile" File="/var/log/vmware/lookupsvc/tomcat/localhost_access.log" Tag="lookupsvc-localhost_access" Severity="info" Facility="local0") #lookupsvc_stream.log.std input(type="imfile" File="/var/log/vmware/lookupsvc/lookupsvc_stream.log.std" Tag="lookupsvc-std" Severity="info" Facility="local0") #lookupserver-default input(type="imfile" File="/var/log/vmware/lookupsvc/lookupserver-default.log" Tag="lookupsvc-lookupserver-default" Severity="info" Facility="local0") #lookupServer input(type="imfile" File="/var/log/vmware/lookupsvc/lookupServer.log" Tag="lookupsvc-lookupServer" Severity="info" Facility="local0") #ls-perflogs input(type="imfile" File="/var/log/vmware/lookupsvc/vmware-lookupservice-perf.log" Tag="lookupsvc-perf" Severity="info" Facility="local0") #ls-gc input(type="imfile" File="/var/log/vmware/lookupsvc/vmware-lookupsvc-gc.log..current" Tag="lookupsvc-gc" Severity="info" Facility="local0")

✔️ Fix

Navigate to and open: /etc/vmware-syslog/vmware-services-lookupsvc.conf Create the file if it does not exist. Set the contents of the file as follows: #localhost_access_log input(type="imfile" File="/var/log/vmware/lookupsvc/tomcat/localhost_access.log" Tag="lookupsvc-localhost_access" Severity="info" Facility="local0") #lookupsvc_stream.log.std input(type="imfile" File="/var/log/vmware/lookupsvc/lookupsvc_stream.log.std*" Tag="lookupsvc-std" Severity="info" Facility="local0") #lookupserver-default input(type="imfile" File="/var/log/vmware/lookupsvc/lookupserver-default.log" Tag="lookupsvc-lookupserver-default" Severity="info" Facility="local0") #lookupServer input(type="imfile" File="/var/log/vmware/lookupsvc/lookupServer.log" Tag="lookupsvc-lookupServer" Severity="info" Facility="local0") #ls-perflogs input(type="imfile" File="/var/log/vmware/lookupsvc/vmware-lookupservice-perf.log" Tag="lookupsvc-perf" Severity="info" Facility="local0") #ls-gc input(type="imfile" File="/var/log/vmware/lookupsvc/vmware-lookupsvc-gc.log.*.current" Tag="lookupsvc-gc" Severity="info" Facility="local0")