Control: 5.2.4 Ensure Server Parameter 'logfiles.retention_days' is greater than 3 days for PostgreSQL flexible Server

Description

Ensure logfiles.retention_days on PostgreSQL flexible servers is set to an appropriate value.

Configuring logfiles.retention_days determines the duration in days that Azure Database for PostgreSQL retains log files. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.

Remediation

From Azure Portal

From Azure Home select the Portal Menu.
Go to Azure Database for PostgreSQL flexible servers.
For each database, under Settings, click Server parameters.
In the filter bar, type logfiles.retention_days.
Input a value between 4 and 7 (inclusive).
Click Save.

From Azure CLI

Use the below command to update logfiles.retention_days configuration:

az postgres flexible-server parameter set --resource-group <resourceGroup> --server-name <serverName> --name logfiles.retention_days --value <4-7>

From Powershell

Use the below command to update logfiles.retention_days configuration:

Update-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name logfiles.retention_days -Value <4-7>

Default Value

By default logfiles.retention_days is set to 3.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v300_5_2_4

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v300_5_2_4 --share

SQL

This control uses a named query:

select
  s.id as resource,
  case
    when (config -> 'ConfigurationProperties' ->> 'value')::integer <= 3 then 'alarm'
    else 'ok'
  end as status,
  case
    when (config -> 'ConfigurationProperties' ->> 'value')::integer <= 3 then s.name || ' log files are retained for 3 days or lesser.'
    else s.name || ' log files are retained for more than 3 days.'
  end as reason
  
  , s.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_postgresql_flexible_server s
  cross join lateral jsonb_array_elements(flexible_server_configurations) as config
  left join azure_subscription as sub on sub.subscription_id = s.subscription_id
where
  config ->> 'Name' = 'logfiles.retention_days';