"Rsyslog" must be configured to monitor VMware Postgres logs.

An XCCDF Rule

Description

<VulnDiscussion>For performance reasons, "rsyslog" file monitoring is preferred over configuring VMware Postgres to send events to a "syslog" facility. Without ensuring that logs are created, that "rsyslog" configs are created, and that those configs are loaded, the log file monitoring and shipping will not be effective. Satisfies: SRG-APP-000359-DB-000319, SRG-APP-000360-DB-000320, SRG-APP-000515-DB-000318</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-256609r887613_rule
Severity: Medium
References: CCI-001851 CCI-001855 CCI-001858
Updated: 8 months ago

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-vpostgres.conf

Create the file if it does not exist.
Set the contents of the file as follows:

# vmware-vpostgres first logs, before loading configuration
input(type="imfile"
      File="/var/log/vmware/vpostgres/serverlog.std*"
      Tag="vpostgres-first"
      Severity="info"
      Facility="local0")
# vmware-vpostgres logs
input(type="imfile"
      File="/var/log/vmware/vpostgres/postgresql-*.log"
      Tag="vpostgres"
      Severity="info"
      Facility="local0")

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf

Create the file if it does not exist.

Set the contents of the file as follows:

# vmware-postgres-archiver logs
input(type="imfile"
      File="/var/log/vmware/vpostgres/pg_archiver.log.std*"
      Tag="postgres-archiver"
      Severity="info"
      Facility="local0")

"Rsyslog" must be configured to monitor VMware Postgres logs.

Description

Remediation - Manual Procedure