3.1.24 Ensure 'log_line_prefix' is set correctly

Information

The log_line_prefix setting specifies a printf-style string that is prefixed to each log line. If blank, no prefix is used. You should configure this as recommended by the pgBadger development team unless directed otherwise by your organization's logging policy.

% characters begin 'escape sequences' that are replaced with status information as outlined below. Unrecognized escapes are ignored. Other characters are copied straight to the logline. Some escapes are only recognized by session processes and will be treated as empty by background processes such as the main server process. Status information may be aligned either left or right by specifying a numeric literal after the % and before the option. A negative value will cause the status information to be padded on the right with spaces to give it a minimum width, whereas a positive value will pad on the left. Padding can be useful to aid human readability in log files.

Any of the following escape sequences can be used:

%a = application name

%u = user name

%d = database name

%r = remote host and port

%h = remote host

%b = backend type

%p = process ID

%P = process ID of parallel group leader

%t = timestamp without milliseconds

%m = timestamp with milliseconds

%n = timestamp with milliseconds (as a Unix epoch)

%Q = query ID (0 if none or not computed)

%i = command tag

%e = SQL state

%c = session ID

%l = session line number

%s = session start timestamp

%v = virtual transaction ID

%x = transaction ID (0 if none)

%q = stop here in non-session processes

%% = '%'

Rationale:

Properly setting log_line_prefix allows for adding additional information to each log entry (such as the user, or the database). Said information may then be of use in auditing or security reviews.

Solution

Execute the following SQL statement(s) to remediate this setting:

postgres=# alter system set log_line_prefix = '%m [%p]: [%l-1] db=%d,user=%u,app=%a,client=%h ';
ALTER SYSTEM
postgres=# select pg_reload_conf();
pg_reload_conf
----------------
t
(1 row)

Default Value:

%m [%p]

See Also

https://workbench.cisecurity.org/benchmarks/14977

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: 1782342d9df5f84d299cdc74b974fdd34960ad8d9165a3d03279e582f3cd013b