Control: 5.2.4 Ensure Server Parameter 'logfiles.retention_days' is greater than 3 days for PostgreSQL flexible Server
Description
Ensure logfiles.retention_days on PostgreSQL flexible servers is set to an appropriate value.
Configuring logfiles.retention_days determines the duration in days that Azure Database for PostgreSQL retains log files. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.
Remediation
From Azure Portal
- From Azure Home select the Portal Menu.
- Go to
Azure Database for PostgreSQL flexible servers. - For each database, under
Settings, clickServer parameters. - In the filter bar, type
logfiles.retention_days. - Input a value between 4 and 7 (inclusive).
- Click
Save.
From Azure CLI
Use the below command to update logfiles.retention_days configuration:
az postgres flexible-server parameter set --resource-group <resourceGroup> --server-name <serverName> --name logfiles.retention_days --value <4-7>
From Powershell
Use the below command to update logfiles.retention_days configuration:
Update-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name logfiles.retention_days -Value <4-7>
Default Value
By default logfiles.retention_days is set to 3.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v300_5_2_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v300_5_2_4 --shareSQL
This control uses a named query:
postgres_flexible_server_log_retention_days_3