ESX Configuration Guide

Prevent the Guest Operating System Processes from Sending Configuration Messages to the Host

You can prevent guests from writing any name-value pairs to the configuration file. This is appropriate when guest operating systems must be prevented from modifying configuration settings.

Procedure

1 Log in to a vCenter Server system using the vSphere Client. 2 Select the virtual machine in the inventory panel.

3On the Summary tab, click Edit Settings.

4Select Options > Advanced > General and click Configuration Parameters.

5Click Add Row and type the following values in the Name and Value columns. n In the Name column: isolation.tools.setinfo.disable

n In the Value column: true

6Click OK to close the Configuration Parameters dialog box, and click OK again to close the Virtual Machine Properties dialog box.

Configuring Logging Levels for the Guest Operating System

Virtual machines can write troubleshooting information into a virtual machine log file stored on the VMFS volume. Virtual machine users and processes can abuse logging either on purpose or inadvertently so that large amounts of data flood the log file. Over time, the log file can consume enough file system space to cause a denial of service.

To prevent this problem, consider modifying logging settings for virtual machine guest operating systems. These settings can limit the total size and number of log files. Normally, a new log file is created each time you reboot a host, so the file can grow to be quite large. You can ensure new log file creation happens more frequently by limiting the maximum size of the log files. VMware recommends saving 10 log files, each one limited to 100KB. These values are large enough to capture sufficient information to debug most problems that might occur.

Each time an entry is written to the log, the size of the log is checked. If it is over the limit, the next entry is written to a new log. If the maximum number of log files exists, the oldest log file is deleted. A DoS attack that avoids these limits could be attempted by writing an enormous log entry, but each log entry is limited in size to 4KB, so no log files are ever more than 4KB larger than the configured limit.

Limit Log File Numbers and Sizes

To prevent virtual machine users and processes from flooding the log file, which can lead to denial of service, you can limit the number and size of the log files ESX generates.

Procedure

1 Log in to a vCenter Server system using the vSphere Client.

2On the Summary tab, click Edit Settings.

3Select Options > General Options and make a record of the path displayed in the Virtual Machine Configuration File text box.

4Log into the service console and acquire root privileges.

Chapter 15 Security Best Practices and Scenarios

5Change directories to access the virtual machine configuration file whose path you recorded in Step 3.

Virtual machine configuration files are located in the /vmfs/volumes/datastore directory, where datastore is the name of the storage device on which the virtual machine files reside. For example, if the virtual machine configuration file you obtained from the Virtual Machine Properties dialog box is [vol1]vm-finance/vm-finance.vmx, you would change to the following directory.

/vmfs/volumes/vol1/vm-finance/

6To limit the log size, use a text editor to add or edit the following line to the .vmx file, where maximum_size is the maximum file size in bytes.

log.rotateSize=maximum_size

For example, to limit the size to around 100KB, enter 100000.

7To keep a limited number of log files, use a text editor to add or edit the following line to the .vmx file, where number_of_files_to_keep is the number of files the server keeps.

log.keepOld=number_of_files_to_keep

For example, to keep 10 log files and begin deleting the oldest ones as new ones are created, enter 10.

8Save your changes and close the file.

Disable Logging for the Guest Operating System

If you choose not to write troubleshooting information into a virtual machine log file stored on the VMFS volume, you can stop logging altogether.

If you disable logging for the guest operating system, be aware that you might not be able to gather adequate logs to allow troubleshooting. Further, VMware does not offer technical support for virtual machine problems if logging has been disabled.

Procedure

1 Log in to a vCenter Server system using the vSphere Client and select the virtual machine in the inventory.

2On the Summary tab, click Edit Settings.

3 Click the Options tab and in the options list under Advanced, select General.

4In Settings, deselect Enable logging.

5Click OK to close the Virtual Machine Properties dialog box.

ESX Configuration Guide