Ensure 'log_line_prefix' is set correctly

MediaNivel 1Automatizadapostgres

Descripción

The log_line_prefix setting specifies a printf-style string that is prefixed to each log line. If blank, no prefix is used. You should configure this as recommended by the pgBadger development team unless directed otherwise by your organization's logging policy. % characters begin "escape sequences" that are replaced with status information as outlined below. Requires the escapes %m %p %l %d %u %a %h (only %d %u %a %h when log_destination is syslog alone). Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

Cómo se verifica

Método de auditoría: Consulta SQL

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT CASE WHEN (SELECT (d = 'syslog' OR (strpos(s, '%m') > 0 AND strpos(s, '%p') > 0 AND strpos(s, '%l') > 0)) AND strpos(s, '%d') > 0 AND strpos(s, '%u') > 0 AND strpos(s, '%a') > 0 AND strpos(s, '%h') > 0 FROM (SELECT current_setting('log_line_prefix') AS s, replace(current_setting('log_destination'), ' ', '') AS d) x) THEN 'compliant' ELSE 'noncompliant' END" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Sentencia SQL

shell

psql -X -U "${PGUSER:-postgres}" -c "ALTER SYSTEM SET log_line_prefix = '%m [%p]: [%l-1] db=%d,user=%u,app=%a,client=%h '" -c "SELECT pg_reload_conf()"

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: postgresdatabaselogging
Referencia: CIS PostgreSQL 18 Benchmark v1.0.0 - 3.1.24 Ensure 'log_line_prefix' is set correctly

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target postgres