Detections
Analytics

3.1.24 Ensure 'log_line_prefix' is set correctly

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The log_line_prefix setting specifies a printf -style string that is prefixed to each log line. If blank, no prefix is used. You should configure this as recommended by the

pgBadger

development team unless directed otherwise by your organization's logging policy.

% characters begin "escape sequences" that are replaced with status information as outlined below. Unrecognized escapes are ignored. Other characters are copied straight to the logline. Some escapes are only recognized by session processes and will be treated as empty by background processes such as the main server process. Status information may be aligned either left or right by specifying a numeric literal after the % and before the option. A negative value will cause the status information to be padded on the right with spaces to give it a minimum width, whereas a positive value will pad on the left. Padding can be useful to aid human readability in log files.

Any of the following escape sequences can be used:

%a = application name
%u = user name
%d = database name
%r = remote host and port
%h = remote host
%b = backend type
%p = process ID
%P = process ID of parallel group leader
%t = timestamp without milliseconds
%m = timestamp with milliseconds
%n = timestamp with milliseconds (as a Unix epoch)
%Q = query ID (0 if none or not computed)
%i = command tag
%e = SQL state
%c = session ID
%l = session line number
%s = session start timestamp
%v = virtual transaction ID
%x = transaction ID (0 if none)
%q = stop here in non-session processes
%% = '%'

Properly setting log_line_prefix allows for adding additional information to each log entry (such as the user, or the database). Said information may then be of use in auditing or security reviews.

Solution

Execute the following SQL statement(s) to remediate this setting:

postgres=# alter system set log_line_prefix = '%m [%r] [%p]: [l-%l] %u@%d,app=%a,e=%e ';
ALTER SYSTEM
postgres=# select pg_reload_conf();
 pg_reload_conf
----------------
 t
(1 row)

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: c69b3abb5dbd2672c1963cdce6f04409486d9fcbd84a518dc6f650a42f594f94