Ensure WAL archiving is configured and functional

中レベル 1自動postgres

説明

Write Ahead Log (WAL) Archiving, or Log Shipping, is the process of sending transaction log files from the PRIMARY host either to one or more STANDBY hosts or to be archived on a remote storage device for later use, e.g. PITR. There are several utilities that can copy WALs including, but not limited to, cp, scp, sftp, and rynsc. Passes when archive_mode is on/always and archive_command or archive_library is set; also confirm pg_stat_archiver shows successful archiving. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

チェック方法

監査方法: SQL クエリ

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT CASE WHEN current_setting('archive_mode') IN ('on','always') AND (current_setting('archive_command') NOT IN ('', '(disabled)') OR current_setting('archive_library') <> '') THEN 'compliant' ELSE 'noncompliant' END" 2>/dev/null) || exit 1; printf '%s\n' "$out"

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Set archive_mode = on and archive_command (e.g. 'pgbackrest --stanza=<name> archive-push %p') or archive_library in postgresql.conf, restart PostgreSQL, then confirm archived_count grows and failed_count stays constant in pg_stat_archiver.

プロパティ

オペレーティングシステム: すべて
タグ: postgresdatabasebackupwal
参照: CIS PostgreSQL 18 Benchmark v1.0.0 - 7.4 Ensure WAL archiving is configured and functional

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target postgres