3.1.23 Ensure 'log_duration' is enabled

Information

Enabling the log_duration setting causes the duration of each completed SQL statement to be logged. For clients using the extended query protocol, durations of the Parse, Bind, and Execute steps are logged independently.
Rationale:
By logging the duration of statements, it is easy to identify both non-performant queries as well as possible DoS attempts (excessively long running queries may be attempts at resource starvation).

Solution

Execute the following SQL statement(s) as superuser to remediate this setting:
postgres=# alter system set log_duration = `on`;
ALTER SYSTEM
postgres=# select pg_reload_conf();
pg_reload_conf
----------------
t
(1 row)
Default Value:
off

See Also

https://workbench.cisecurity.org/files/2234

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12, CSCv6|6, CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: d9be7e39202b9095e5b16d38ad7cf7f49cbfbcb1c714f1a503f0409461cd10e5