STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Jul 2026:

The vCenter PostgreSQL service must off-load audit data to a separate log management facility.

DISA Rule

SV-259185r1210431_rule

Vulnerability Number

V-259185

Group Title

SRG-APP-000515-DB-000318

Rule Version

VCPG-80-000122

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-vpostgres.conf

Create the file if it does not exist.

Set the contents of the file as follows:

# vmware-vpostgres first logs stdout, before loading configuration
input(type="imfile"
File="/var/log/vmware/vpostgres/serverlog.stdout"
Tag="vpostgres-first"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
# vmware-vpostgres first logs stderr, before loading configuration
input(type="imfile"
File="/var/log/vmware/vpostgres/serverlog.stderr"
Tag="vpostgres-first"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
# vmware-vpostgres logs
input(type="imfile"
File="/var/log/vmware/vpostgres/postgresql-*.log"
Tag="vpostgres"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf

Create the file if it does not exist.

Set the contents of the file as follows:

# vmware-postgres-archiver stdout log
input(type="imfile"
File="/var/log/vmware/vpostgres/pg_archiver.log.stdout"
Tag="postgres-archiver"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
# vmware-postgres-archiver stderr log
input(type="imfile"
File="/var/log/vmware/vpostgres/pg_archiver.log.stderr"
Tag="postgres-archiver"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Check Contents

By default, a vmware-services-vmware-vpostgres.conf rsyslog and vmware-services-vmware-postgres-archiver.conf configuration file include the service logs when syslog is configured on vCenter, but they must be verified.

At the command prompt, run the following command:

# cat /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf

Expected result:

# vmware-vpostgres first logs stdout, before loading configuration
input(type="imfile"
File="/var/log/vmware/vpostgres/serverlog.stdout"
Tag="vpostgres-first"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
# vmware-vpostgres first logs stderr, before loading configuration
input(type="imfile"
File="/var/log/vmware/vpostgres/serverlog.stderr"
Tag="vpostgres-first"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
# vmware-vpostgres logs
input(type="imfile"
File="/var/log/vmware/vpostgres/postgresql-*.log"
Tag="vpostgres"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Note: If the entries for "deleteStateOnFileDelete" and "reopenOnTruncate" do not exist, this is not a finding.

If the output does not match the expected result, this is a finding.

At the command prompt, run the following command:

# cat /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf

Expected result:

# vmware-postgres-archiver stdout log
input(type="imfile"
File="/var/log/vmware/vpostgres/pg_archiver.log.stdout"
Tag="postgres-archiver"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
# vmware-postgres-archiver stderr log
input(type="imfile"
File="/var/log/vmware/vpostgres/pg_archiver.log.stderr"
Tag="postgres-archiver"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Note: If the entries for "deleteStateOnFileDelete" and "reopenOnTruncate" do not exist, this is not a finding.

If the output does not match the expected result, this is a finding.

Vulnerability Number

V-259185

Documentable

False

Rule Version

VCPG-80-000122

Severity Override Guidance

By default, a vmware-services-vmware-vpostgres.conf rsyslog and vmware-services-vmware-postgres-archiver.conf configuration file include the service logs when syslog is configured on vCenter, but they must be verified.

At the command prompt, run the following command:

# cat /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf

Expected result:

# vmware-vpostgres first logs stdout, before loading configuration
input(type="imfile"
File="/var/log/vmware/vpostgres/serverlog.stdout"
Tag="vpostgres-first"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
# vmware-vpostgres first logs stderr, before loading configuration
input(type="imfile"
File="/var/log/vmware/vpostgres/serverlog.stderr"
Tag="vpostgres-first"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
# vmware-vpostgres logs
input(type="imfile"
File="/var/log/vmware/vpostgres/postgresql-*.log"
Tag="vpostgres"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Note: If the entries for "deleteStateOnFileDelete" and "reopenOnTruncate" do not exist, this is not a finding.

If the output does not match the expected result, this is a finding.

At the command prompt, run the following command:

# cat /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf

Expected result:

# vmware-postgres-archiver stdout log
input(type="imfile"
File="/var/log/vmware/vpostgres/pg_archiver.log.stdout"
Tag="postgres-archiver"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")
# vmware-postgres-archiver stderr log
input(type="imfile"
File="/var/log/vmware/vpostgres/pg_archiver.log.stderr"
Tag="postgres-archiver"
Severity="info"
Facility="local0"
deleteStateOnFileDelete="on"
reopenOnTruncate="on")

Note: If the entries for "deleteStateOnFileDelete" and "reopenOnTruncate" do not exist, this is not a finding.

If the output does not match the expected result, this is a finding.

Check Content Reference

M

Target Key

5570