Detections
Analytics

3.1.7 Ensure 'log_truncate_on_rotation' is enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enabling the log_truncate_on_rotation setting when logging_collector is enabled causes PostgreSQL to truncate (overwrite) existing log files with the same name during log rotation instead of appending to them. For example, using this setting in combination with a log_filename setting value like postgresql-%H.log would result in generating 24 hourly log files and then cyclically overwriting them:

 postgresql-00.log

 postgresql-01.log

 [...]

 postgresql-23.log

 Note: Truncation will occur only when a new file is being opened due to time-based rotation, not during server startup or size-based rotation (see later in this benchmark for size-based rotation details).

 Rationale:

 If this setting is disabled, pre-existing log files will be appended to if log_filename is configured in such a way that static names are generated.

 Enabling or disabling the truncation should only be decided when also considering the value of log_filename and log_rotation_age/log_rotation_size. Some examples to illustrate the interaction between these settings:

 # truncation is moot, as each rotation gets a unique filename (postgresql-20180605.log)

 log_truncate_on_rotation = on

 log_filename = 'postgresql-%Y%m%d.log'

 log_rotation_age = '1d'

 log_rotation_size = 0

 # truncation every hour, losing log data every hour until the date changes

 log_truncate_on_rotation = on

 log_filename = 'postgresql-%Y%m%d.log'

 log_rotation_age = '1h'

 log_rotation_size = 0

 # no truncation if the date changed while generating 100M of log data, truncation otherwise

 log_truncate_on_rotation = on

 log_filename = 'postgresql-%Y%m%d.log'

 log_rotation_age = '0'

 log_rotation_size = '100M'

Solution

Execute the following SQL statement(s) to remediate this setting:

 postgres=# alter system set log_truncate_on_rotation = 'on';
 ALTER SYSTEM
 postgres=# select pg_reload_conf();
 pg_reload_conf
 ----------------
 t
 (1 row)
 postgres=# show log_truncate_on_rotation;
 log_truncate_on_rotation
 --------------------------
 on
 (1 row)

 Default Value:

 on

 References:

 https://www.postgresql.org/docs/12/static/runtime-config-logging.html

 Notes:

 Be sure to consider your organization's logging retention policies and the use of any external log consumption tools before deciding if truncation should be enabled or disabled.

See Also

https://workbench.cisecurity.org/files/2536

Item Details

References: CSCv6|6.3, CSCv7|6.4

Plugin: PostgreSQLDB

Control ID: f314e5391aaf12520e242fc836f5bb0451777521247549cd8410fd33f107216b