Control: 4.3.4 Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server

Description

Enable log_disconnections on PostgreSQL Servers.

Enabling log_disconnections helps PostgreSQL Database to Logs end of a session, including duration, which in turn generates query and error logs. Query and error logs scan be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.

Remediation

From Azure Console

From Azure Home select the Portal Menu
Go to Azure Database for PostgreSQL server
For each database, click on Server parameters
Search for log_disconnections.
Click ON and save.

From Powershell

Use the below command to update log_disconnections configuration.

az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_disconnections --value on

Default Value

By default log_disconnections is disabled.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v150_4_3_4

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v150_4_3_4 --share

SQL

This control uses a named query:

select
  s.id as resource,
  case
    when lower(config -> 'ConfigurationProperties' ->> 'value') != 'on' then 'alarm'
    else 'ok'
  end as status,
  case
    when lower(config -> 'ConfigurationProperties' ->> 'value') != 'on' then name || ' server parameter log_disconnections off.'
    else name || ' server parameter log_disconnections on.'
  end as reason
  
  , s.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_postgresql_server s,
  jsonb_array_elements(server_configurations) config,
  azure_subscription sub
where
  config ->> 'Name' = 'log_disconnections'
  and sub.subscription_id = s.subscription_id;