cancel
Showing results for 
Search instead for 
Did you mean: 

What logs from Vmware ESX are useful?

Jump to solution

Hi all,

Does anyone have an insight into what logs from Vmware ESX produce useful events in ESM?  According to our ESX admins, it's "all or nothing" as far as Syslog, and ESX is very chatty.  I've already filtered the application "vxpa," which was the noisiest one, but the logs I'm still getting don't have a lot of security-related information.

Thanks,

- Steve

1 Solution

Accepted Solutions
Highlighted
McAfee Employee mherr
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: What logs from Vmware ESX are useful?

Jump to solution

There are different approaches you can take with this.

As you stated, there are 1100+ parsers and 282 data source rules.  

How do you plan to eliminate the low value events?  Disable parsing or filters?  You can do it either way, but the preference would be to filter them at the source or the ERC.  .

Anything you decide to keep in the SIEM should be use case driven. Do you need the events for alarms, correlation, reports, or views? If no, then filter them out.  Need them for compliance, send to ELM only.  To determine what to keep/filter, you can filter the events based on normalization.  Maybe start wtih the normalized dashboard and look at authentication, configuration changes.   You can look at the normalization categories that you don't care about, review the events and either filter them out or disable the parsers.   

4 Replies
McAfee Employee mherr
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: What logs from Vmware ESX are useful?

Jump to solution

Here are some events that should be monitored.  

- Authentication Activity 

- VM Activity, such as creation, modification, deletion, cloning, backups

 - Start/Shutdown of VMs

- Any configuration changes

 

Re: What logs from Vmware ESX are useful?

Jump to solution
Hi,

Thanks for the pointers. Are you able to expand on your answer at all? My receiver has 1,100 ASP parsers for VMware, but VMware itself seems to group events into a much small number of applications (i.e., vpxa, hostd, rhttpproxy, hostd-probe, etc.)

Best,
- Steve
Highlighted
McAfee Employee mherr
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: What logs from Vmware ESX are useful?

Jump to solution

There are different approaches you can take with this.

As you stated, there are 1100+ parsers and 282 data source rules.  

How do you plan to eliminate the low value events?  Disable parsing or filters?  You can do it either way, but the preference would be to filter them at the source or the ERC.  .

Anything you decide to keep in the SIEM should be use case driven. Do you need the events for alarms, correlation, reports, or views? If no, then filter them out.  Need them for compliance, send to ELM only.  To determine what to keep/filter, you can filter the events based on normalization.  Maybe start wtih the normalized dashboard and look at authentication, configuration changes.   You can look at the normalization categories that you don't care about, review the events and either filter them out or disable the parsers.   

Re: What logs from Vmware ESX are useful?

Jump to solution

Hi,

Thanks again.  I understand the procedure.  What I was really hoping for from this post is to get some information from other users who are sending logs from ESX servers and who have done this tuning already.  It doesn't look like that is going to be forthcoming.

Best,

- Steve

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator