Control: 4.3.6 Ensure server parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
Description
It is recommended to enable log_retention_days on PostgreSQL Servers. Enabling log_retention_days helps PostgreSQL database to sets number of days a log file is retained which in turn generates query and error logs. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.
Remediation
From Console
- Login to Azure console and navigate to PostgreSQL Servers.
- For each database, go to
Settingssection from left pane. - Click on
Server parameters. - Search for
log_retention_days. - Enter value in range of
4-7and click save.
From Command Line
Command to update log_retention_days configuration
az postgres server configuration show --resource-group <resourceGroupName> --server-name <serverName> --name log_retention_days
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v140_4_3_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v140_4_3_6 --shareSQL
This control uses a named query:
postgres_db_server_log_retention_days_3