Detections
Analytics
3.1.25 Ensure 'log_statement' is set correctly
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
The log_statement setting specifies the types of SQL statements that are logged. Valid values are:- none (off)
- ddl
- mod
- all (all statements)
It is recommended this be set to ddl unless otherwise directed by your organization's logging policy.
ddl logs all data definition statements:
- CREATE
- ALTER
- DROP
mod logs all ddl statements, plus data-modifying statements:
- INSERT
- UPDATE
- DELETE
- TRUNCATE
- COPY FROM
( PREPARE EXECUTE and EXPLAIN ANALYZE statements are also logged if their contained command is of an appropriate type.)
For clients using extended query protocol, logging occurs when an Execute message is received, and values of the Bind parameters are included (with any embedded single-quote marks doubled).
Setting log_statement to align with your organization's security and logging policies facilitates later auditing and review of database activities.
Solution
Execute the following SQL statement(s) as superuser to remediate this setting:postgres=# alter system set log_statement='ddl';
ALTER SYSTEM
postgres=# select pg_reload_conf();
pg_reload_conf
----------------
t
(1 row)
See Also
Item Details
Audit Name: CIS PostgreSQL 17 v1.0.0 L1 PostgreSQL
References: CSCv7|6.3
Plugin: PostgreSQLDB
Control ID: a4ad99fac0615985fee90cafddc58fd1253c44a5a56fb3833b6fb576584e1172