Detections
Analytics

3.1.10 Ensure the correct syslog facility is selected

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The syslog_facility setting specifies the syslog "facility" to be used when logging to syslog is enabled. You can choose from any of the 'local' facilities:

 - LOCAL0
 - LOCAL1
 - LOCAL2
 - LOCAL3
 - LOCAL4
 - LOCAL5
 - LOCAL6
 - LOCAL7

Your organization's logging policy should dictate which facility to use based on the syslog daemon in use.

If not set to the appropriate facility, the PostgreSQL log messages may be intermingled with other applications' log messages, incorrectly routed, or potentially dropped (depending on your syslog configuration).

Solution

Execute the following SQL statement(s) to remediate this setting (in this example, setting it to the LOCAL1 facility):

postgres=# alter system set syslog_facility = 'LOCAL1';
ALTER SYSTEM
postgres=# select pg_reload_conf();
 pg_reload_conf
----------------
 t
(1 row)

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|6.2

Plugin: PostgreSQLDB

Control ID: 4f0d3b01875ac03b6746e6bf45ce346a50d36a1778b8657cf7bce73eb958967f