TMA-POSTGRES-3.1.24

Ensure 'log_line_prefix' is set correctly

MoyenneNiveau 1Automatiséepostgres

Description

The log_line_prefix setting specifies a printf-style string that is prefixed to each log line. If blank, no prefix is used. You should configure this as recommended by the pgBadger development team unless directed otherwise by your organization's logging policy. % characters begin "escape sequences" that are replaced with status information as outlined below. Requires the escapes %m %p %l %d %u %a %h (only %d %u %a %h when log_destination is syslog alone). Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

Méthode de vérification

Méthode d'audit: Requête SQL

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT CASE WHEN (SELECT (d = 'syslog' OR (strpos(s, '%m') > 0 AND strpos(s, '%p') > 0 AND strpos(s, '%l') > 0)) AND strpos(s, '%d') > 0 AND strpos(s, '%u') > 0 AND strpos(s, '%a') > 0 AND strpos(s, '%h') > 0 FROM (SELECT current_setting('log_line_prefix') AS s, replace(current_setting('log_destination'), ' ', '') AS d) x) THEN 'compliant' ELSE 'noncompliant' END" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Instruction SQL

shell

psql -X -U "${PGUSER:-postgres}" -c "ALTER SYSTEM SET log_line_prefix = '%m [%p]: [%l-1] db=%d,user=%u,app=%a,client=%h '" -c "SELECT pg_reload_conf()"

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: postgresdatabaselogging
Référence: CIS PostgreSQL 18 Benchmark v1.0.0 - 3.1.24 Ensure 'log_line_prefix' is set correctly

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target postgres