turbot/azure_compliance

Control: 5.2.7 [LEGACY]Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL single Server

Description

Enable log_disconnections on PostgreSQL Servers.

NOTE: This recommendation currently only applies to Single Server, not Flexible Server. See additional information below for details about the planned retirement of Azure PostgreSQL Single Server.

Enabling log_disconnections helps PostgreSQL Database to Logs end of a session, including duration, which in turn generates query and error logs. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.

Remediation

From Azure Portal

  1. From Azure Home select the Portal Menu.
  2. Go to Azure Database for PostgreSQL servers.
  3. For each database, under Settings, click Server parameters.
  4. Search for log_disconnections.
  5. Set log_disconnections to ON.
  6. Click Save.

From Azure CLI

Use the below command to update log_disconnections configuration.

az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_disconnections --value on

From PowerShell

Use the below command to update log_disconnections configuration.

Update-AzPostgreSqlConfiguration -ResourceGroupName <ResourceGroupName> -ServerName <ServerName> -Name log_disconnections -Value on

Default Value

By default log_disconnections is disabled (set to off).

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v300_5_2_7

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v300_5_2_7 --share

SQL

This control uses a named query:

postgres_db_server_log_disconnections_on

Tags