Ensure WAL archiving is configured and functional

中等級 1自動化postgres

說明

Write Ahead Log (WAL) Archiving, or Log Shipping, is the process of sending transaction log files from the PRIMARY host either to one or more STANDBY hosts or to be archived on a remote storage device for later use, e.g. PITR. There are several utilities that can copy WALs including, but not limited to, cp, scp, sftp, and rynsc. Passes when archive_mode is on/always and archive_command or archive_library is set; also confirm pg_stat_archiver shows successful archiving. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

檢查方式

稽核方法: SQL 查詢

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT CASE WHEN current_setting('archive_mode') IN ('on','always') AND (current_setting('archive_command') NOT IN ('', '(disabled)') OR current_setting('archive_library') <> '') THEN 'compliant' ELSE 'noncompliant' END" 2>/dev/null) || exit 1; printf '%s\n' "$out"

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Set archive_mode = on and archive_command (e.g. 'pgbackrest --stanza=<name> archive-push %p') or archive_library in postgresql.conf, restart PostgreSQL, then confirm archived_count grows and failed_count stays constant in pg_stat_archiver.

屬性

作業系統: 不限
標籤: postgresdatabasebackupwal
參考資料: CIS PostgreSQL 18 Benchmark v1.0.0 - 7.4 Ensure WAL archiving is configured and functional

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target postgres