VCPG-70-000019 - 'Rsyslog' must be configured to monitor VMware Postgres logs.

Information

For performance reasons, 'rsyslog' file monitoring is preferred over configuring VMware Postgres to send events to a 'syslog' facility. Without ensuring that logs are created, that 'rsyslog' configs are created, and that those configs are loaded, the log file monitoring and shipping will not be effective.

Satisfies: SRG-APP-000359-DB-000319, SRG-APP-000360-DB-000320, SRG-APP-000515-DB-000318

Solution

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-vpostgres.conf

Create the file if it does not exist.

Set the contents of the file as follows:

# vmware-vpostgres first logs, before loading configuration
input(type='imfile'
File='/var/log/vmware/vpostgres/serverlog.std*'
Tag='vpostgres-first'
Severity='info'
Facility='local0')
# vmware-vpostgres logs
input(type='imfile'
File='/var/log/vmware/vpostgres/postgresql-*.log'
Tag='vpostgres'
Severity='info'
Facility='local0')

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf

Create the file if it does not exist.

Set the contents of the file as follows:

# vmware-postgres-archiver logs
input(type='imfile'
File='/var/log/vmware/vpostgres/pg_archiver.log.std*'
Tag='postgres-archiver'
Severity='info'
Facility='local0')

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), 800-53|AU-5(1), 800-53|AU-5(2), CAT|II, CCI|CCI-001851, CCI|CCI-001855, CCI|CCI-001858, Rule-ID|SV-256609r887613_rule, STIG-ID|VCPG-70-000019, Vuln-ID|V-256609

Plugin: Unix

Control ID: fc8b13020229f43a15040684d0fe70ab53fb6f982aa11acd9e2157968c65eeee