3.1.4 Ensure the log file destination directory is set correctly

Information

The log_directory setting specifies the destination directory for log files when log_destination is stderr or csvlog. It can be specified as relative to the cluster data directory ($PGDATA) or as an absolute path. log_directory should be set according to your organization's logging policy.

Rationale:

If log_directory is not set, it is interpreted as the absolute path '/' and PostgreSQL will attempt to write its logs there (and typically fail due to a lack of permissions to that directory). This parameter should be set to direct the logs into the appropriate directory location as defined by your organization's logging policy.

Solution

Execute the following SQL statement(s) to remediate this setting:

postgres=# alter system set log_directory='/var/log/postgres';
ALTER SYSTEM
postgres=# select pg_reload_conf();
pg_reload_conf
----------------
t
(1 row)
postgres=# show log_directory;
log_directory
---------------
/var/log/postgres
(1 row)

Note: The use of /var/log/postgres, above, is an example. This should be set to an appropriate path as defined by your organization's logging requirements. Having said that, it is a good idea to have the logs outside of your PGDATA directory so that they are not included by things like pg_basebackup or pgBackRest.

Default Value:

log which is relative to the cluster's data directory (e.g. /var/lib/pgsql/<pgmajorversion>/data/log)

See Also

https://workbench.cisecurity.org/benchmarks/14977

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: a9b2fd3c6d947d2e767114cad291ea258b4e7e52e6e42ab6e1c10d5ffd728aa9