STIGhub
STIGs
RMF Controls
Compare
← AU-3 — Content of Audit Records
CCI-000131
Definition
Ensure that audit records containing information that establishes when the event occurred.
Parent Control
AU-3
Content of Audit Records
Audit and Accountability
Linked STIG Checks (161)
V-204647
CAT II
AAA Services configuration audit records must identify when (date and time) the events occurred.
AAA Services Security Requirements Guide
V-279034
CAT III
ColdFusion must produce log records containing information to establish what type of events occurred.
Adobe ColdFusion Security Technical Implementation Guide
V-274017
CAT II
Amazon Linux 2023 must have the audit package installed.
Amazon Linux 2023 Security Technical Implementation Guide
V-274018
CAT II
Amazon Linux 2023 must produce audit records containing information to establish what type of events occurred.
Amazon Linux 2023 Security Technical Implementation Guide
V-268090
CAT II
The NixOS audit package must be installed.
Anduril NixOS Security Technical Implementation Guide
V-214232
CAT II
The Apache web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214311
CAT II
The Apache web server must produce log records containing sufficient information to establish what type of events occurred.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-222939
CAT II
Date and time of events must be logged.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-252464
CAT II
The macOS system must initiate session audits at system startup, using internal clocks with time stamps for audit records that meet a minimum granularity of one second and can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT), in order to generate audit records containing information to establish what type of events occurred, the identity of any individual or process associated with the event, including individual identities of group account users, establish where the events occurred, source of the event, and outcome of the events including all account enabling actions, full-text recording of privileged commands, and information about the use of encryption for access wireless access to and from the system.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257170
CAT II
The macOS system must produce audit records containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-268454
CAT II
The macOS system must enable security auditing.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277062
CAT II
The macOS system must enable security auditing.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-204929
CAT II
The ALG must produce audit records containing information to establish when (date and time) the events occurred.
Application Layer Gateway Security Requirements Guide
V-222473
CAT II
The application must produce audit records containing information to establish when (date and time) the events occurred.
Application Security and Development Security Technical Implementation Guide
V-204722
CAT II
The application server must produce log records containing sufficient information to establish when (date and time) the events occurred.
Application Server Security Requirements Guide
V-255962
CAT II
The Arista network device must be configured to capture all DOD auditable events.
Arista MLS EOS 4.X NDM Security Technical Implementation Guide
V-272369
CAT II
The print-time variable for the configuration of BIND 9.x server logs must be configured to establish when (date and time) the events occurred.
BIND 9.x Security Technical Implementation Guide
V-219225
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238298
CAT II
The Ubuntu operating system must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DoD-defined auditable events and actions in near real time.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260590
CAT II
Ubuntu 22.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-260591
CAT II
Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270656
CAT II
Ubuntu 24.04 LTS must have the "auditd" package installed.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-270657
CAT II
Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-221909
CAT III
The Central Log Server must produce audit records containing information to establish when (date and time) the events occurred.
Central Log Server Security Requirements Guide
V-271939
CAT II
The Cisco ACI must automatically audit account creation.
Cisco ACI NDM Security Technical Implementation Guide
V-239856
CAT II
The Cisco ASA must be configured to generate traffic log entries containing information to establish when (date and time) the events occurred.
Cisco ASA Firewall Security Technical Implementation Guide
V-239874
CAT II
The Cisco ASA must be configured to produce audit records containing information to establish when the events occurred.
Cisco ASA IPS Security Technical Implementation Guide
V-239906
CAT II
The Cisco ASA must be configured to produce audit records containing information to establish when (date and time) the events occurred.
Cisco ASA NDM Security Technical Implementation Guide
V-239946
CAT III
The Cisco ASA must be configured to generate log records containing information to establish when the events occurred.
Cisco ASA VPN Security Technical Implementation Guide
V-215672
CAT II
The Cisco router must produce audit records containing information to establish when (date and time) the events occurred.
Cisco IOS Router NDM Security Technical Implementation Guide
V-220580
CAT II
The Cisco switch must produce audit records containing information to establish when (date and time) the events occurred.
Cisco IOS Switch NDM Security Technical Implementation Guide
V-215817
CAT II
The Cisco router must produce audit records containing information to establish when (date and time) the events occurred.
Cisco IOS XE Router NDM Security Technical Implementation Guide
V-220528
CAT II
The Cisco switch must produce audit records containing information to establish when (date and time) the events occurred.
Cisco IOS XE Switch NDM Security Technical Implementation Guide
V-216527
CAT II
The Cisco router must produce audit records containing information to establish when (date and time) the events occurred.
Cisco IOS XR Router NDM Security Technical Implementation Guide
V-269469
CAT II
The audit package must be installed on AlmaLinux OS 9.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233043
CAT II
The container platform audit records must have a date and time association with all events.
Container Platform Security Requirements Guide
V-233608
CAT II
PostgreSQL must produce audit records containing time stamps to establish when the events occurred.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261867
CAT II
PostgreSQL must produce audit records containing time stamps to establish when the events occurred.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-255540
CAT III
The DBN-6300 must produce audit records containing information to establish when (date and time) the events occurred.
DBN-6300 NDM Security Technical Implementation Guide
V-206529
CAT II
The DBMS must produce audit records containing time stamps to establish when the events occurred.
Database Security Requirements Guide
V-269774
CAT II
The Dell OS10 Switch must initiate session auditing upon startup.
Dell OS10 Switch NDM Security Technical Implementation Guide
V-235778
CAT II
The audit log configuration level must be set to request in the Universal Control Plane (UCP) component of Docker Enterprise.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-235779
CAT II
The host operating systems auditing policies for the Docker Engine - Enterprise component of Docker Enterprise must be set.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-205162
CAT II
The DNS server implementation must produce audit records containing information to establish when (date and time) the events occurred.
Domain Name System (DNS) Security Requirements Guide
V-224136
CAT II
The EDB Postgres Advanced Server must generate audit records for DoD-defined auditable events.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213571
CAT II
The EDB Postgres Advanced Server must produce audit records containing time stamps to establish when the events occurred.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259956
CAT II
The Enterprise Voice, Video, and Messaging Endpoint must be configured to produce session (call detail) records containing when (date and time) the connection occurred.
Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide
V-259997
CAT II
The Enterprise Voice, Video, and Messaging Session Manager must produce session (call) records containing timestamps (date and time) for all session connections.
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide
V-259220
CAT II
The EDB Postgres Advanced Server must produce audit records containing time stamps to establish when the events occurred.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-266146
CAT II
The F5 BIG-IP appliance must generate event log records that can be forwarded to the centralized events log.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-266256
CAT II
The F5 BIG-IP appliance must generate traffic log entries containing information to establish the details of the event, including success or failure of the application of the firewall rule.
F5 BIG-IP TMOS Firewall Security Technical Implementation Guide
V-266068
CAT II
The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.
F5 BIG-IP TMOS NDM Security Technical Implementation Guide
V-278385
CAT II
NGINX must provide audit records for DOD-defined auditable events.
F5 NGINX Security Technical Implementation Guide
V-206679
CAT II
The firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.
Firewall Security Requirements Guide
V-234136
CAT II
The FortiGate firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.
Fortinet FortiGate Firewall Security Technical Implementation Guide
V-203605
CAT II
The operating system must produce audit records containing information to establish when (date and time) the events occurred.
General Purpose Operating System Security Requirements Guide
V-217441
CAT III
The HP FlexFabric Switch must produce audit records containing information to establish when (date and time) the events occurred.
HP FlexFabric Switch NDM Security Technical Implementation Guide
V-255267
CAT II
SSMC web server must generate, at a minimum, log records for system startup and shutdown, system access, and system authentication events.
HPE 3PAR SSMC Web Server Security Technical Implementation Guide
V-268245
CAT II
The HYCU virtual appliance must produce audit records containing information to establish when events occurred, where events occurred, the source of the event, the outcome of the event, and identity of any individual or process associated with the event.
HYCU Protege Security Technical Implementation Guide
V-215236
CAT II
AIX must produce audit records containing information to establish what the date, time, and type of events that occurred.
IBM AIX 7.x Security Technical Implementation Guide
V-256887
CAT II
Audit records content must contain valid information to allow for proper incident reporting.
IBM Hardware Management Console (HMC) Security Technical Implementation Guide
V-255782
CAT II
The MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-250325
CAT II
The WebSphere Liberty Server must log remote session and security activity.
IBM WebSphere Liberty Server Security Technical Implementation Guide
V-223544
CAT II
IBM z/OS Required SMF data record types must be collected.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223546
CAT II
IBM z/OS must specify SMF data options to assure appropriate activation.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223653
CAT II
IBM RACF SETROPTS LOGOPTIONS must be properly configured.
IBM z/OS RACF Security Technical Implementation Guide
V-223767
CAT II
IBM z/OS required SMF data record types must be collected.
IBM z/OS RACF Security Technical Implementation Guide
V-223769
CAT II
IBM z/OS must specify SMF data options to assure appropriate activation.
IBM z/OS RACF Security Technical Implementation Guide
V-223998
CAT II
IBM z/OS required SMF data record types must be collected.
IBM z/OS TSS Security Technical Implementation Guide
V-224001
CAT II
IBM z/OS must specify SMF data options to ensure appropriate activation.
IBM z/OS TSS Security Technical Implementation Guide
V-237899
CAT II
CA VM:Secure product must be installed and operating.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-34541
CAT II
The IDPS must produce audit records containing information to establish when (date and time) the events occurred.
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide
V-206868
CAT II
The IDPS must produce audit records containing information to establish when (date and time) the events occurred.
Intrusion Detection and Prevention Systems Security Requirements Guide
V-258601
CAT II
The ICS must be configured to audit the execution of privileged functions such as accounts additions and changes.
Ivanti Connect Secure NDM Security Technical Implementation Guide
V-258587
CAT III
The ICS must be configured to generate log records containing sufficient information about where, when, identity, source, or outcome of the events.
Ivanti Connect Secure VPN Security Technical Implementation Guide
V-251016
CAT III
The Sentry must produce audit records containing information to establish when (date and time) the events occurred.
Ivanti MobileIron Sentry 9.x ALG Security Technical Implementation Guide
V-251016
CAT III
The Sentry must produce audit records containing information to establish when (date and time) the events occurred.
Ivanti Sentry 9.x ALG Security Technical Implementation Guide
V-213508
CAT II
JBoss Log Formatter must be configured to produce log records that establish the date and time the events occurred.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-253890
CAT II
The Juniper EX switch must be configured to produce audit records containing information to establish when (date and time) the events occurred.
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V-242403
CAT II
Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event.
Kubernetes Security Technical Implementation Guide
V-213813
CAT II
SQL Server must produce Trace or Audit records containing sufficient information to establish when the events occurred.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-205465
CAT II
The Mainframe Product must produce audit records containing information to establish when (date and time) the events occurred.
Mainframe Product Security Requirements Guide
V-221160
CAT II
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252134
CAT II
MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265907
CAT II
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279334
CAT II
MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-202031
CAT II
The network device must produce audit records containing information to establish when (date and time) the events occurred.
Network Device Management Security Requirements Guide
V-254165
CAT II
Nutanix AOS must produce audit records containing information to establish when events occurred.
Nutanix AOS 5.20.x OS Security Technical Implementation Guide
V-219755
CAT II
The DBMS must produce audit records containing sufficient information to establish when (date and time) the events occurred.
Oracle Database 11.2g Security Technical Implementation Guide
V-220271
CAT II
The DBMS must produce audit records containing sufficient information to establish when (date and time) the events occurred.
Oracle Database 12c Security Technical Implementation Guide
V-221316
CAT II
OHS must have a log format defined for log records generated to capture sufficient information to establish when an event occurred.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221317
CAT II
OHS must have a SSL log format defined for log records generated to capture sufficient information to establish when an event occurred.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221318
CAT II
OHS must have a log file defined for each site/virtual host to capture logs generated that allow the establishment of when an event occurred.
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide
V-221764
CAT II
The Oracle Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.
Oracle Linux 7 Security Technical Implementation Guide
V-248519
CAT II
The OL 8 audit package must be installed.
Oracle Linux 8 Security Technical Implementation Guide
V-248520
CAT II
OL 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
Oracle Linux 8 Security Technical Implementation Guide
V-271519
CAT II
OL 9 must have the audit package installed.
Oracle Linux 9 Security Technical Implementation Guide
V-271520
CAT II
OL 9 audit service must be enabled.
Oracle Linux 9 Security Technical Implementation Guide
V-235945
CAT III
Oracle WebLogic must produce audit records containing sufficient information to establish when (date and time) the events occurred.
Oracle WebLogic Server 12c Security Technical Implementation Guide
V-214142
CAT II
PostgreSQL must produce audit records containing time stamps to establish when the events occurred.
PostgreSQL 9.x Security Technical Implementation Guide
V-273788
CAT II
The RUCKUS ICX device must initiate session auditing upon startup.
RUCKUS ICX NDM Security Technical Implementation Guide
V-252844
CAT II
Rancher MCM must generate audit records for all DoD-defined auditable events within all components in the platform.
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide
V-254555
CAT II
Rancher RKE2 components must be configured in accordance with the security configuration settings based on DOD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V-280993
CAT II
RHEL 10 must have the "audit" package installed.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-280994
CAT II
RHEL 10 must enable the audit service.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-204503
CAT II
The Red Hat Enterprise Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-258151
CAT II
RHEL 9 audit package must be installed.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-258152
CAT II
RHEL 9 audit service must be enabled.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-257521
CAT II
OpenShift audit records must have a date and time association with all events.
Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide
V-257521
CAT II
OpenShift audit records must have a date and time association with all events.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-275452
CAT I
The Riverbed NetIM must enable and configure user audit logging.
Riverbed NetIM NDM Security Technical Implementation Guide
V-275677
CAT II
Ubuntu OS must have the "auditd" package installed.
Riverbed NetIM OS Security Technical Implementation Guide
V-275678
CAT II
Ubuntu OS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time.
Riverbed NetIM OS Security Technical Implementation Guide
V-256072
CAT I
The Riverbed NetProfiler must be configured to automatically generate DOD-required audit records with sufficient information to support incident reporting to a central log server.
Riverbed NetProfiler Security Technical Implementation Guide
V-206718
CAT II
The SDN controller must be configured to produce audit records containing information to establish when the events occurred.
SDN Controller Security Requirements Guide
V-254092
CAT II
Innoslate must generate comprehensive audit records.
SPEC Innovations Innoslate 4.x Security Technical Implementation Guide
V-261411
CAT II
SLEM 5 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217191
CAT II
SUSE operating system audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-216254
CAT II
Audit records must include when (date and time) the events occurred.
Solaris 11 SPARC Security Technical Implementation Guide
V-216019
CAT II
Audit records must include when (date and time) the events occurred.
Solaris 11 X86 Security Technical Implementation Guide
V-279177
CAT II
The Edge SWG must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.
Symantec Edge SWG ALG Security Technical Implementation Guide
V-279255
CAT II
The Edge SWG must produce audit records containing information to establish when (date and time) the events occurred.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-94247
CAT II
Symantec ProxySG must produce audit records containing information to establish when (date and time) the events occurred.
Symantec ProxySG ALG Security Technical Implementation Guide
V-242176
CAT II
The TPS must provide audit record generation capability for detection events based on implementation of policy filters, rules, signatures, and anomaly analysis.
Trend Micro TippingPoint IDPS Security Technical Implementation Guide
V-242259
CAT I
The TippingPoint SMS must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).
Trend Micro TippingPoint NDM Security Technical Implementation Guide
V-252973
CAT II
TOSS audit records must contain information to establish what type of events occurred, when the events occurred, the source of events, where events occurred, and the outcome of events.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-234329
CAT II
The UEM server must be configured to produce audit records containing information to establish when (date and time) the events occurred.
Unified Endpoint Management Server Security Requirements Guide
V-240046
CAT II
HAProxy must log when events occurred.
VMW vRealize Automation 7.x HA Proxy Security Technical Implementation Guide
V-240281
CAT II
vRA PostgreSQL database log file data must contain required data elements.
VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide
V-239778
CAT II
The vROps PostgreSQL DB must produce audit records containing time stamps to establish when the events occurred.
VMW vRealize Operations Manager 6.x PostgreSQL Security Technical Implementation Guide
V-265612
CAT III
The NSX Distributed Firewall must generate traffic log entries that can be sent by the ESXi hosts to the central syslog.
VMware NSX 4.x Distributed Firewall Security Technical Implementation Guide
V-265362
CAT II
The NSX Tier-0 Gateway Firewall must generate traffic log entries.
VMware NSX 4.x Tier-0 Gateway Firewall Security Technical Implementation Guide
V-265488
CAT II
The NSX Tier-1 Gateway firewall must generate traffic log entries.
VMware NSX 4.x Tier-1 Gateway Firewall Security Technical Implementation Guide
V-251727
CAT II
The NSX-T Distributed Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Distributed Firewall Security Technical Implementation Guide
V-251762
CAT III
The NSX-T Tier-1 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Tier 1 Gateway Firewall Security Technical Implementation Guide
V-251737
CAT III
The NSX-T Tier-0 Gateway Firewall must generate traffic log entries containing information to establish the details of the event.
VMware NSX-T Tier-0 Gateway Firewall Security Technical Implementation Guide
V-240221
CAT II
Lighttpd must produce log records containing sufficient information to establish when (date and time) events occurred.
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide
V-240752
CAT II
tc Server HORIZON must produce log records containing sufficient information to establish when (date and time) events occurred.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240753
CAT II
tc Server VCO must produce log records containing sufficient information to establish when (date and time) events occurred.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-240754
CAT II
tc Server VCAC must produce log records containing sufficient information to establish when (date and time) events occurred.
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide
V-241602
CAT II
tc Server UI must produce log records containing sufficient information to establish when (date and time) events occurred.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241603
CAT II
tc Server CaSa must produce log records containing sufficient information to establish when (date and time) events occurred.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-241604
CAT II
tc Server API must produce log records containing sufficient information to establish when (date and time) events occurred.
VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide
V-256650
CAT II
VAMI must produce log records containing sufficient information to establish what type of events occurred.
VMware vSphere 7.0 VAMI Security Technical Implementation Guide
V-256677
CAT II
ESX Agent Manager must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance EAM Security Technical Implementation Guide
V-256710
CAT II
Lookup Service must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-256615
CAT II
Performance Charts must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-256488
CAT II
The Photon operating system must configure auditd to use the correct log format.
VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide
V-256592
CAT II
VMware Postgres log files must contain required fields.
VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-256749
CAT II
The Security Token Service must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance STS Security Technical Implementation Guide
V-256782
CAT II
vSphere UI must record user access in a format that enables monitoring of remote access.
VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide
V-259006
CAT II
The vCenter ESX Agent Manager service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance ESX Agent Manager (EAM) Security Technical Implementation Guide
V-259040
CAT II
The vCenter Lookup service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Lookup Service Security Technical Implementation Guide
V-259140
CAT II
The vCenter VAMI service must produce log records containing sufficient information to establish what type of events occurred.
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide
V-259074
CAT II
The vCenter Perfcharts service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Perfcharts Security Technical Implementation Guide
V-259171
CAT II
The vCenter PostgreSQL service must produce logs containing sufficient information to establish what type of events occurred.
VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide
V-258974
CAT II
The vCenter STS service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) Security Technical Implementation Guide
V-259107
CAT II
The vCenter UI service must produce log records containing sufficient information regarding event details.
VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide
V-207353
CAT II
The VMM must produce audit records containing information to establish when (date and time) the events occurred.
Virtual Machine Manager Security Requirements Guide
V-207196
CAT III
The VPN Gateway must generate log records containing information to establish when (date and time) the events occurred.
Virtual Private Network (VPN) Security Requirements Guide
V-206360
CAT II
The web server must produce log records containing sufficient information to establish when (date and time) events occurred.
Web Server Security Requirements Guide