The vCenter PostgreSQL service must off-load audit data to a separate log management facility.

An XCCDF Rule

Description

<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. The database management system (DBMS) may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-259185r961860_rule
Severity: Medium
References: CCI-001851
Updated: 17 days ago

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-vpostgres.conf

Create the file if it does not exist.
Set the contents of the file as follows:

# vmware-vpostgres first logs stdout, before loading configuration
input(type="imfile"
      File="/var/log/vmware/vpostgres/serverlog.stdout"
      Tag="vpostgres-first"
      Severity="info"
      Facility="local0")
# vmware-vpostgres first logs stderr, before loading configuration
input(type="imfile"
      File="/var/log/vmware/vpostgres/serverlog.stderr"
      Tag="vpostgres-first"
      Severity="info"
      Facility="local0")
# vmware-vpostgres logs
input(type="imfile"
      File="/var/log/vmware/vpostgres/postgresql-*.log"
      Tag="vpostgres"
      Severity="info"
      Facility="local0")

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf

Create the file if it does not exist.

Set the contents of the file as follows:

# vmware-postgres-archiver stdout log
input(type="imfile"
      File="/var/log/vmware/vpostgres/pg_archiver.log.stdout"
      Tag="postgres-archiver"
      Severity="info"
      Facility="local0")
# vmware-postgres-archiver stderr log
input(type="imfile"
      File="/var/log/vmware/vpostgres/pg_archiver.log.stderr"
      Tag="postgres-archiver"
      Severity="info"
      Facility="local0")

The vCenter PostgreSQL service must off-load audit data to a separate log management facility.

Description

Remediation - Manual Procedure