Control: 4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
Description
Ensure log_retention_days on PostgreSQL Servers is set to an appropriate value.
Configuring log_retention_days determines the duration in days that Azure Database for PostgreSQL retains log files. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.
Remediation
From Azure Portal
- From Azure Home select the Portal Menu.
- Go to
Azure Database for PostgreSQL servers. - For each database, click on
Server parameters. - Search for
log_retention_days. - Input a value between 4 and 7 (inclusive) and click
Save.
From Azure CLI
Use the below command to update log_retention_days configuration.
az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_retention_days --value <4-7>
From Powershell
Use the below command to update log_retention_days configuration.
Update-AzPostgreSqlConfiguration -ResourceGroupName <ResourceGroupName> - ServerName <ServerName> -Name log_retention_days -Value <4-7>
Default Value
By default log_retention_days is set to 3.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v200_4_3_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v200_4_3_6 --shareSQL
This control uses a named query:
postgres_db_server_log_retention_days_3