# Cis Tomcat101 10.15

> Do not resolve hosts on logging valves (Automated)

- Skill: `cyberstrikeus/cis-tomcat101-10-15` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-tomcat101-10-15`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-tomcat101-10-15/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-tomcat101-10-15

---


# 10.15 Do not resolve hosts on logging valves (Automated)

## Description

Setting `enableLookups` to `true` on Connector will result in a DNS look-ups to obtain the host name of the remote client before logging any information. This uses additional resources when logging.

## Rationale

Allowing `enableLookups` adds additional overhead to resolve the host name of a remote client which is rarely needed.

## Audit Procedure

Ensure Connector elements have the `enableLookups` attribute does not exist or is set to `false`.

```
# grep enableLookups $CATALINA_HOME/conf/server.xml
```

## Remediation

In Connector elements, set the `enableLookups` attribute to `false` or remove it.

```xml
<Connector ... enableLookups="false" />
```

## Default Value

By default, DNS lookups are disabled.

## References

1. https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html
2. https://tomcat.apache.org/tomcat-9.0-doc/config/http.html

## CIS Controls

| Controls Version | Control                                                                                                                           | IG 1 | IG 2 | IG 3 |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 9.2 Use DNS Filtering Services<br>Use DNS filtering services on all enterprise assets to block access to known malicious domains. | ●    | ●    | ●    |
| v7               | 7.7 Use of DNS Filtering Services<br>Use DNS filtering services to help block access to known malicious domains.                  | ●    | ●    | ●    |

## Profile

Level 2