Skip to main content

lacework-global-546

Set server parameter 'log_disconnections' to 'ON' for PostgreSQL Database Server (Automated)

Profile Applicability

• Level 1

Description

Enable log_disconnections on PostgreSQL Servers.

Rationale

Enabling log_disconnections helps PostgreSQL Database to Logs end of a session, including duration, which in turn generates query and error logs. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.

Impact

Enabling this setting will enable a log of all disconnections. If this is enabled for a high traffic server, the log may grow exponentially.

Audit

From Azure Portal

  1. From Azure Home select the Portal Menu
  2. Go to Azure Database for PostgreSQL server
  3. For each database, click on Server parameters
  4. Search for log_disconnections.
  5. Ensure that value is set to ON.

From Azure Powershell

Ensure log_connections value is set to ON

az postgres server configuration show --resource-group <resourceGroupName> --server-name <serverName> --name log_disconnections

Remediation

From Azure Portal

  1. From Azure Home select the Portal Menu.
  2. Go to Azure Database for PostgreSQL servers.
  3. For each database, click Server parameters.
  4. Search for log_disconnections.
  5. Click ON and save.

From Azure Powershell

Use the below command to update log_disconnections configuration.

az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_disconnections --value on

References

https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server
https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-4-enable-logging-for-azure-resources