"Rsyslog" must be configured to monitor VMware Postgres logs.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-256609	SRG-APP-000359-DB-000319	VCPG-70-000019	SV-256609r887613_rule	2023-06-15	1

Description
For performance reasons, "rsyslog" file monitoring is preferred over configuring VMware Postgres to send events to a "syslog" facility. Without ensuring that logs are created, that "rsyslog" configs are created, and that those configs are loaded, the log file monitoring and shipping will not be effective. Satisfies: SRG-APP-000359-DB-000319, SRG-APP-000360-DB-000320, SRG-APP-000515-DB-000318

ℹ️ Check
At the command prompt, run the following command: # rpm -V VMware-Postgres-cis-visl-scripts\|grep -E "vmware-services-vmware-vpostgres.conf\|vmware-services-vmware-postgres-archiver.conf" \| grep "^..5......" If the command returns any output, this is a finding.

✔️ Fix
Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-vpostgres first logs, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.std" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres logs input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-.log" Tag="vpostgres" Severity="info" Facility="local0") Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-postgres-archiver logs input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.std*" Tag="postgres-archiver" Severity="info" Facility="local0")

✔️ Fix

Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-vpostgres first logs, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.std*" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres logs input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-*.log" Tag="vpostgres" Severity="info" Facility="local0") Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-postgres-archiver logs input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.std*" Tag="postgres-archiver" Severity="info" Facility="local0")