3.1.19 Ensure 'log_disconnections' is enabled

Information

Enabling the log_disconnections setting logs the end of each session, including session duration. This parameter cannot be changed after session start.

Rationale:

PostgreSQL does not maintain the beginning or ending of a connection internally for later review. It is only by enabling the logging of these that one can examine connections for failed attempts, 'over long' duration, or other anomalies.

Solution

Execute the following SQL statement(s) to enable this setting:

postgres=# alter system set log_disconnections = 'on';
ALTER SYSTEM
postgres=# select pg_reload_conf();
pg_reload_conf
----------------
t
(1 row)

Default Value:

off

See Also

https://workbench.cisecurity.org/files/2306

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12, CSCv6|6, CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: fd39514205f3946b2474e1c9934a929b783d100aeddae6d97f906f43084fc345