3.1.3 Ensure the logging collector is enabled

Information

The logging collector is a background process that captures log messages sent to stderr and redirects them into log files. The logging_collector setting must be enabled in order for this process to run. It can only be set at server start.

Rationale:

The logging collector approach is often more useful than logging to syslog, since some types of messages might not appear in syslog output. One common example is dynamic-linker failure message; another may be error messages produced by scripts such as archive_command.

Note: This setting must be enabled when log_destination is either 'stderr' or 'csvlog' and for certain other logging parameters to take effect.

Solution

Execute the following SQL statement(s) to remediate this setting:

postgres=# alter system set logging_collector = 'on';
ALTER SYSTEM
Unfortunately, this setting can only be changed at server (re)start. As root, restart the PostgreSQL service for this change to take effect:
[root@centos7 ~]# whoami
root
[root@centos7 ~]# systemctl restart postgresql-11
[root@centos7 ~]# systemctl status postgresql-11|grep 'ago$'
Active: active (running) since <date>; 1s ago

Default Value:

on

See Also

https://workbench.cisecurity.org/files/2407

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-12, CSCv6|6.2, CSCv7|6.2, CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: 6349f10fc72ba6e5695fab4c2eefe06aa0c4a113433c0ead6503f7940143b723