3.1.29 Ensure all temporary files are logged

Information

Temporary files are created for sorts, hashes, and temporary query results when these operations exceed work_mem. A log entry is made for each temporary file when it is deleted. Setting log_temp_files to 0 causes all temporary file information to be logged, while positive values log only files whose size is greater than or equal to the specified number of kilobytes. A value of -1 disables temporary file information logging.
Unless directed otherwise by your organization's logging policy, you should set this to 0.
Rationale:
If all temporary files are not logged, it may be more difficult to identify potential performance issues that may be either poor application coding or deliberate resource starvation attempts.

Solution

Execute the following SQL statement(s) as superuser to remediate this setting:
postgres=# alter system set log_temp_files = 0;
ALTER SYSTEM
postgres=# select pg_reload_conf();
pg_reload_conf
----------------
t
(1 row)
Default Value:
-1

See Also

https://workbench.cisecurity.org/files/2234

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12, CSCv6|6, CSCv7|6.3

Plugin: PostgreSQLDB

Control ID: 8033bdf5031b72055876ed4659a03029d042046d3911d1419f18c8bde970ccd9