Details

In the event of a system failure, the system must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.

Solution

From the vSphere Web Client select the ESXi Host and right click. Select the ‘Add Diagnostic Partition’ option configure a core dump diagnostic partition.

or

From a PowerCLI command prompt while connected to the ESXi host run at least one of the following sets of commands:

To configure a core dump partition:

$esxcli = Get-EsxCli
#View available partitions to configure
$esxcli.system.coredump.partition.list()
$esxcli.system.coredump.partition.set($null,’PartitionName’,$null,$null)

To configure a core dump collector:

$esxcli = Get-EsxCli
$esxcli.system.coredump.network.set($null,’vmkernel port to use’,$null,’CollectorIP’,’CollectorPort’)
$esxcli.system.coredump.network.set($true)

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-5_Y21M10_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Unix.

References

• 800-53|SC-24
• CAT|III
• CCI|CCI-001665
• Rule-ID|SV-207645r379318_rule
• STIG-ID|ESXI-65-000044
• STIG-Legacy|SV-104121
• STIG-Legacy|V-94035
• Vuln-ID|V-207645

Source

• Tenable.com/audits