Skip to main content

lacework-global-548

Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server (Automated)

Profile Applicability

• Level 1

Description

Set log_retention_days on PostgreSQL Servers to an appropriate value.

Rationale

Enabling log_retention_days helps PostgreSQL Database to Sets number of days a log file is retained which in turn generates query and error logs. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.

Impact

Enabling this setting will enable logs to be retained for the number entered. If this is enabled for a high traffic server, the log may grow quickly to occupy a large amount of disk space. In this case you may want to set this to a lower number.

Audit

From Azure Portal

  1. From Azure Home select the Portal Menu
  2. Go to Azure Database for PostgreSQL server
  3. For each database, click on Server parameters
  4. Search for log_retention_days.
  5. Ensure that value greater than 3.

From Azure CLI

Ensure log_retention_days value is greater than 3.

az postgres server configuration show --resource-group <resourceGroupName> --server-name <serverName> --name log_retention_days

Remediation

From Azure Portal

  1. From Azure Home select the Portal Menu.
  2. Go to Azure Database for PostgreSQL servers.
  3. For each database, click Server parameters.
  4. Search for log_retention_days.
  5. Input a value between 4 and 7 (inclusive) and click Save.

From Azure CLI

Use the below command to update log_retention_days configuration.

az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_retention_days --value <4-7>

References

https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal
https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-6-configure-log-storage-retention