cyberstrikeus 7.2 Specify file handler in logging.properties files (Automated)
Description
Handlers specify where log messages are sent. Console handlers send log messages to the Java console and File handlers specify logging to a file.
Rationale
Utilizing file handlers will ensure that security event information is persisted to disk.
Impact
Configuring logging to debug logging, i.e. FINEST or ALL, can generate large amounts of information which may impact server performance.
Audit Procedure
Review each application's logging.properties file located in the applications $CATALINA_BASE/webapps/<app_name>/WEB-INF/classes directory and determine if the file handler properties are set.
$ grep handlers \
$ CATALINA_BASE/webapps/<app_name>/WEB-INF/classes/logging.properties
In the instance where an application specific logging has not been created, the logging.properties file will be located in $CATALINA_BASE/conf
$ grep handlers $CATALINA_BASE/conf/logging.properties
Remediation
Add the following entries, replacing <file_handler> with either FileHandler or AsyncFileHandler, to your logging.properties file if they do not exist.
handlers=1catalina.org.apache.juli.<file_handler>,
2localhost.org.apache.juli.<file_handler>,
3manager.org.apache.juli.<file_handler>, 4host-
manager.org.apache.juli.<file_handler>, java.util.logging.ConsoleHandler
Ensure logging is not off and set the <logging_level> to the desired level (SEVERE, WARNING, INFO, CONFIG, FINE, FINER, FINEST or ALL), for example:
org.apache.juli.FileHandler.level=<logging_level>
Default Value
No value for new applications by default.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.5 Collect Detailed Audit LogsConfigure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. | ● | ● | |
| v7 | 6.3 Enable Detailed LoggingEnable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements. | ● | ● |
Profile
Level 1