Ensure 'log_line_prefix' is set correctly

MediaNivel 1Automatizadayugabytedb

Descripción

The log_line_prefix setting specifies a printf-style string that is prefixed to each logline. If blank, no prefix is used. You should configure this as recommended by the pgBadger development team unless directed otherwise by your organization's logging policy. % characters begin "escape sequences" that are replaced with status information as outlined below. Unrecognized escapes are ignored. Runs ysqlsh (add the YugabyteDB bin directory to PATH) against PGHOST/PGPORT (default 127.0.0.1:5433) as PGUSER (default yugabyte); supply the password through PGPASSWORD or ~/.pgpass. Passes when log_line_prefix contains every escape of the minimum '%m [%p]: [%l-1] db=%d,user=%u,app=%a,client=%h' (%m %p %l %d %u %a %h).

Cómo se verifica

Método de auditoría: Consulta SQL

sql_query

out=$(ysqlsh -h "${PGHOST:-127.0.0.1}" -p "${PGPORT:-5433}" -U "${PGUSER:-yugabyte}" -d "${PGDATABASE:-yugabyte}" -tAc "SHOW log_line_prefix" 2>/dev/null) || exit 1; for t in '%m' '%p' '%l' '%d' '%u' '%a' '%h'; do case "$out" in *"$t"*) ;; *) echo "missing $t"; exit 0;; esac; done; echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set it with the YB-TServer GFlag --ysql_pg_conf_csv="\"log_line_prefix='%m [%p]: [%l-1] db=%d,user=%u,app=%a,client=%h '\"" on every YB-TServer and restart it.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: yugabytedblogging
Referencia: CIS YugabyteDB Benchmark v2.0.0 - 3.1.21 Ensure 'log_line_prefix' is set correctly

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target yugabytedb