3.1.3 Ensure the logging collector is enabled

Information

The logging collector is a background process that captures log messages sent to stderr and redirects them into log files. The logging_collector setting must be enabled in order for this process to run. It can only be set at the server start.

Rationale:

The logging collector approach is often more useful than logging to syslog, since some types of messages might not appear in syslog output. One common example is dynamic-linker failure message; another may be error messages produced by scripts such as archive_command.

Note: This setting must be enabled when log_destination is either stderr or csvlog or logs will be lost. Certain other logging parameters require it as well.

Solution

Execute the following SQL statement(s) to remediate this setting:

postgres=# alter system set logging_collector = 'on';
ALTER SYSTEM

Unfortunately, this setting can only be changed at the server (re)start. As root, restart the PostgreSQL service for this change to take effect:

# whoami
root
# systemctl restart postgresql-12
# systemctl status postgresql-12|grep 'ago$'
Active: active (running) since <date>; <count>s ago

Default Value:

on

See Also

https://workbench.cisecurity.org/benchmarks/11861

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: 16bec2cd59e8449e32049b1631382fee1f030e9e51ed36a1a1dabd72880acb8f