Details

Ensure the className attribute is set to AccessLogValve. The className attribute determines the access log valve to be used for logging.

Rationale:

Some log valves are not suited for production and should not be used. Apache recommends org.apache.catalina.valves.AccessLogValve

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Add the following statement into the $CATALINA_HOME/webapps//META-INF/context.xml file if it does not already exist.

className=’org.apache.catalina.valves.AccessLogValve’
directory=’$CATALINA_HOME/logs/’
prefix=’access_log’
fileDateFormat=’yyyy-MM-dd.HH’
suffix=’.log’
pattern=’%t %H cookie:%{SESSIONID}c request:%{SESSIONID}r %m %U %s %q %r’
/>

Default Value:

Does not exist by default.

References:

https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/2506

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.

References

• 800-53|AU-12
• CSCv7|6.3

Source

• Tenable.com/audits