Detections
Analytics

3.1.7 Ensure 'log_truncate_on_rotation' is enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enabling the log_truncate_on_rotation setting when logging_collector is enabled causes PostgreSQL to truncate (overwrite) existing log files with the same name during log rotation instead of appending to them. For example, using this setting in combination with a log_filename setting value like postgresql-%H.log would result in generating 24 hourly log files and then cyclically overwriting them:

postgresql-00.log
postgresql-01.log
[...]
postgresql-23.log

Note: Truncation will occur

only

when a new file is being opened due to time-based rotation, not during server startup or size-based rotation (see later in this benchmark for size-based rotation details).

If this setting is disabled, pre-existing log files will be appended to if log_filename is configured in such a way that static or recurring names are generated.

Enabling or disabling the truncation should only be decided when also considering the value of log_filename and log_rotation_age / log_rotation_size Some examples to illustrate the interaction between these settings:

# truncation is moot, as each rotation gets a unique filename (postgresql-20180605.log)
log_truncate_on_rotation = on
log_filename = 'postgresql-%Y%m%d.log'
log_rotation_age = '1d'
log_rotation_size = 0# truncation every hour, losing log data every hour until the date changes
log_truncate_on_rotation = on
log_filename = 'postgresql-%Y%m%d.log'
log_rotation_age = '1h'
log_rotation_size = 0# no truncation if the date changed before generating 100M of log data, truncation otherwise
log_truncate_on_rotation = on
log_filename = 'postgresql-%Y%m%d.log'
log_rotation_age = '0'
log_rotation_size = '100M'

Solution

Execute the following SQL statement(s) to remediate this setting:

postgres=# alter system set log_truncate_on_rotation = 'on';
ALTER SYSTEM
postgres=# select pg_reload_conf();
 pg_reload_conf
----------------
 t
(1 row)
postgres=# show log_truncate_on_rotation;
 log_truncate_on_rotation
--------------------------
 on
(1 row)

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|6.4

Plugin: PostgreSQLDB

Control ID: c1c5ca9eb83cc8240d86859ed8d6faa73782cf8ee5fe597e8abdfacea4abd081