Detections
Analytics

3.1.21 Ensure 'log_disconnections' is enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enabling the log_disconnections setting logs the end of each session, including session duration. This parameter cannot be changed after the session start.

PostgreSQL does not maintain the beginning or ending of a connection internally for later review. It is only by enabling the logging of these that one can examine connections for failed attempts, 'over long' duration, or other anomalies.

Note that enabling this without also enabling log_connections provides little value. Generally, you would enable/disable the pair together.

Solution

Execute the following SQL statement(s) to enable this setting:

postgres=# alter system set log_disconnections = 'on';
ALTER SYSTEM
postgres=# select pg_reload_conf();
 pg_reload_conf
----------------
 t
(1 row)
postgres=# show log_disconnections;
 log_disconnections
--------------------
 on
(1 row)

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: d2c3380fcca7954b7a81ea46c57b0b979285feedf061956951680d293102dbc5