Details

The access logfile format is defined within a Valve that implements the org.apache.catalina.valves.AccessLogValve interface within the /opt/tomcat/server.xml configuration file: The %h pattern code is included in the pattern element and logs the remote hostname. Including the hostname pattern in the log configuration provides useful information about the connecting host that is critical for troubleshooting and forensic investigations.

Solution

As a privileged user on the Tomcat server:

Edit the $CATALINA_BASE/conf/server.xml file.

Modify the element(s) nested within the element(s).

Change the AccessLogValve setting to include %h in the pattern= statement.

EXAMPLE:
unpackWARs=’true’ autoDeploy=’false’>
…
prefix=’localhost_access_log’ suffix=’.txt’
pattern=’%h %l %t %u "%r" %s %b’ />
…

Restart the Tomcat server:
sudo systemctl restart tomcat
sudo systemctl daemon-reload

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Tomcat_Application_Server_9_V2R3_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.

References

• 800-53|AU-3
• CAT|II
• CCI|CCI-000132
• Rule-ID|SV-222940r615938_rule
• STIG-ID|TCAT-AS-000250
• STIG-Legacy|SV-111409
• STIG-Legacy|V-102463
• Vuln-ID|V-222940

Source

• Tenable.com/audits