V-240965

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Protecting log data is important during a forensic investigation to ensure investigators can track and understand what may have occurred. Off-loading should be set up as a scheduled task but can be configured to be run manually, if other processes during the off-loading are manual. Off-loading is a common process in information systems with limited log storage capacity.

Check Content

At the command prompt, execute the following command:

grep traceFile /opt/vmware/etc/sfcb/sfcb.cfg

If the value of "traceFile" is not "syslog', this is a finding.