Rsyslog must be configured to monitor VMware Postgres logs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239214	VCPG-67-000022	SV-239214r717064_rule		Medium

Description
For performance reasons, rsyslog file monitoring is preferred over configuring VMware Postgres to send events to a syslog facility. Without ensuring that logs are created, that rsyslog configs are created, and that those configs are loaded, the log file monitoring and shipping will not be effective. Satisfies: SRG-APP-000359-DB-000319, SRG-APP-000360-DB-000320, SRG-APP-000092-DB-000208

STIG	Date
VMware vSphere 6.7 PostgreSQL Security Technical Implementation Guide	2021-04-15

Details

Check Text ( C-42447r679013_chk )
At the command prompt, execute the following command: # cat /etc/vmware-syslog/stig-services-vpostgres.conf Expected result: input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.std" Tag="vpostgres-first" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-.log" Tag="vpostgres" Severity="info" Facility="local0") If the file does not exist, this is a finding. If the output of the command does not match the expected result above, this is a finding. If there is no output from the command, vPostgres will default to "stderr", and this is not a finding.

Check Text ( C-42447r679013_chk )

At the command prompt, execute the following command:

# cat /etc/vmware-syslog/stig-services-vpostgres.conf

Expected result:

input(type="imfile"
File="/var/log/vmware/vpostgres/serverlog.std*"
Tag="vpostgres-first"
Severity="info"
Facility="local0")

input(type="imfile"
File="/var/log/vmware/vpostgres/postgresql-*.log"
Tag="vpostgres"
Severity="info"
Facility="local0")

If the file does not exist, this is a finding.

If the output of the command does not match the expected result above, this is a finding.

If there is no output from the command, vPostgres will default to "stderr", and this is not a finding.

Fix Text (F-42406r679014_fix)
Navigate to and open /etc/vmware-syslog/stig-services-vpostgres.conf. Create the file if it does not exist. Set the contents of the file as follows: input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.std" Tag="vpostgres-first" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-.log" Tag="vpostgres" Severity="info" Facility="local0")