Ensure the maximum log file lifetime is set correctly

낮음레벨 1자동yugabytedb

설명

When logging_collector is enabled, the log_rotation_age parameter determines the maximum lifetime of an individual log file (depending on the value of log_filename). After this many minutes have elapsed, a new log file will be created via automatic log file rotation. Current best practices advise log rotation at least daily, but your organization's logging policy should dictate your rotation schedule. Runs ysqlsh (add the YugabyteDB bin directory to PATH) against PGHOST/PGPORT (default 127.0.0.1:5433) as PGUSER (default yugabyte); supply the password through PGPASSWORD or ~/.pgpass. Passes when time-based rotation is enabled (log_rotation_age > 0, default 1d); confirm the value matches the logging policy.

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(ysqlsh -h "${PGHOST:-127.0.0.1}" -p "${PGPORT:-5433}" -U "${PGUSER:-yugabyte}" -d "${PGDATABASE:-yugabyte}" -tAc "SELECT CASE WHEN setting::bigint > 0 THEN 'compliant' ELSE 'disabled' END FROM pg_settings WHERE name = 'log_rotation_age'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set it with the YB-TServer GFlag --ysql_pg_conf_csv="log_rotation_age='1d'" (or the value your policy requires) on every YB-TServer and restart it.

속성

운영 체제: 모두
태그: yugabytedblogging
참고 자료: CIS YugabyteDB Benchmark v2.0.0 - 3.1.5 Ensure the maximum log file lifetime is set correctly

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target yugabytedb