Ensure 'log_error_verbosity' is set correctly

LowLevel 1Automatedpostgres

Description

The log_error_verbosity setting specifies the verbosity (amount of detail) of logged messages. Valid values are: ; TERSE ; DEFAULT ; VERBOSE with each containing the fields of the level above it as well as additional fields. TERSE excludes the logging of DETAIL, HINT, QUERY, and CONTEXT error information. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

How it is checked

Audit method: SQL query

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SHOW log_error_verbosity" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Expected output: verbose

How it is fixed

Fix method: SQL statement

shell

psql -X -U "${PGUSER:-postgres}" -c "ALTER SYSTEM SET log_error_verbosity = 'verbose'" -c "SELECT pg_reload_conf()"

Properties

Operating systems: Any
Tags: postgresdatabaselogging
Reference: CIS PostgreSQL 18 Benchmark v1.0.0 - 3.1.22 Ensure 'log_error_verbosity' is set correctly

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target postgres