UCF STIG Viewer Logo

vRA PostgreSQL database log file data must contain required data elements.


Overview

Finding ID Version Rule ID IA Controls Severity
V-89341 VRAU-PG-000060 SV-99991r1_rule Medium
Description
Information system auditing capability is critical for accurate forensic analysis. Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident. In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as application components, modules, session identifiers, filenames, host names, and functionality. Associating information about where the event occurred within the application provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application.
STIG Date
VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide 2018-10-12

Details

Check Text ( C-89033r1_chk )
At the command prompt, execute the following command:

# grep '^\s*log_line_prefix\b' /storage/db/pgdata/postgresql.conf

If "log_line_prefix" is not set to "%m %d %u %r %p %l %c", this is a finding.
Fix Text (F-96083r1_fix)
At the command prompt, execute the following commands:

# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET log_line_prefix TO '%m %d %u %r %p %l %c';"
# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"