3.1.8 Ensure the maximum log file lifetime is set correctly

Information

When logging_collector is enabled, the log_rotation_age parameter determines the maximum lifetime of an individual log file (depending on the value of log_filename). After this many minutes have elapsed, a new log file will be created via automatic log file rotation. Current best practices advise log rotation at least daily, but your organization's logging policy should dictate your rotation schedule.

Rationale:

Log rotation is a standard best practice for log management.

Solution

Execute the following SQL statement(s) to remediate this setting (in this example, setting it to one hour):

postgres=# alter system set log_rotation_age='1h';
ALTER SYSTEM
postgres=# select pg_reload_conf();
pg_reload_conf
----------------
t
(1 row)

Default Value:

1d (one day)

See Also

https://workbench.cisecurity.org/files/2306

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, CSCv6|6.3, CSCv7|6.4

Plugin: PostgreSQLDB

Control ID: 1c8249db80fc193f65d1e9a81687435be044c97d2edfc4284dd9712745766d32