Detections
Analytics

3.1.4 Ensure the log file destination directory is set correctly

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The log_directory setting specifies the destination directory for log files when log_destination is stderr or csvlog It can be specified as relative to the cluster data directory ( $PGDATA ) or as an absolute path. log_directory should be set according to your organization's logging policy.

If log_directory is not set, it is interpreted as the absolute path '/' and PostgreSQL will attempt to write its logs there (and typically fail due to a lack of permissions to that directory). This parameter should be set to direct the logs into the appropriate directory location as defined by your organization's logging policy.

Solution

Execute the following SQL statement(s) to remediate this setting:

postgres=# alter system set log_directory='/var/log/postgres';
ALTER SYSTEM
postgres=# select pg_reload_conf();
 pg_reload_conf
----------------
 t
(1 row)
postgres=# show log_directory;
 log_directory
---------------
 /var/log/postgres
(1 row)

Note: The use of /var/log/postgres above, is an example. This should be set to an appropriate path as defined by your organization's logging requirements. Having said that, it is a good idea to have the logs outside of your PGDATA directory so that they are not included by things like pg_basebackup or pgBackRest

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|6.2, CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: 0d12f9e583bf331446fda67cdbe8d26a010fcb15c1b077a4a1880ca69a1f229c