What logs from Vmware ESX are useful?

[rskadish-dexia]

Hi all,

Does anyone have an insight into what logs from Vmware ESX produce useful events in ESM?  According to our ESX admins, it's "all or nothing" as far as Syslog, and ESX is very chatty.  I've already filtered the application "vxpa," which was the noisiest one, but the logs I'm still getting don't have a lot of security-related information.

Thanks,

- Steve

[mherr]

Here are some events that should be monitored.  

- Authentication Activity 

- VM Activity, such as creation, modification, deletion, cloning, backups

 - Start/Shutdown of VMs

- Any configuration changes

[rskadish-dexia]

Hi,

Thanks for the pointers. Are you able to expand on your answer at all? My receiver has 1,100 ASP parsers for VMware, but VMware itself seems to group events into a much small number of applications (i.e., vpxa, hostd, rhttpproxy, hostd-probe, etc.)

Best,
- Steve

[mherr · Accepted solution]

There are different approaches you can take with this.

As you stated, there are 1100+ parsers and 282 data source rules.  

How do you plan to eliminate the low value events?  Disable parsing or filters?  You can do it either way, but the preference would be to filter them at the source or the ERC.  .

Anything you decide to keep in the SIEM should be use case driven. Do you need the events for alarms, correlation, reports, or views? If no, then filter them out.  Need them for compliance, send to ELM only.  To determine what to keep/filter, you can filter the events based on normalization.  Maybe start wtih the normalized dashboard and look at authentication, configuration changes.   You can look at the normalization categories that you don't care about, review the events and either filter them out or disable the parsers.   

[rskadish-dexia]

Hi,

Thanks again.  I understand the procedure.  What I was really hoping for from this post is to get some information from other users who are sending logs from ESX servers and who have done this tuning already.  It doesn't look like that is going to be forthcoming.

Best,

- Steve