Ensure that "log_disconnections" database flag is enabled for all your Google Cloud PostgreSQL database instances. When this flag is enabled, PostgreSQL database logs the end of each session. The log output provides information similar to the one generated by the "log_connections" flag, plus the duration of the session. The database flag can be changed at the session start, and it cannot be changed during a session.
This rule resolution is part of the Conformity Security & Compliance tool for GCP.
By default, "log_disconnections" configuration flag is disabled. PostgreSQL database engine does not log information such as session duration and session end by default. Enabling the "log_disconnections" flag starts recording PostgreSQL activity data that can be useful to identify, troubleshoot, and repair configuration errors and sub-optimal performance for your Cloud PostgreSQL database instances.
Note: Some database flag settings can affect instance availability and/or stability, and eventually remove the PostgreSQL instance from the Google Cloud SQL Service Level Agreement (SLA).
Audit
To determine if "log_disconnections" flag is enabled for your Google Cloud PostgreSQL database instances, perform the following operations:
Remediation / Resolution
To enable the "log_disconnections" database flag for your Google Cloud Platform (GCP) PostgreSQL database instances, perform the following operations:
References
- Google Cloud Platform (GCP) Documentation
- Cloud SQL for PostgreSQL
- Configuring database flags
- Editing instances
- CIS Security Documentation
- Securing Google Cloud Computing Platform
- PostgreSQL Database Documentation
- 19.8. Error Reporting and Logging
- GCP Command Line Interface (CLI) Documentation
- gcloud projects list
- gcloud sql instances list
- gcloud sql instances describe
- gcloud sql instances patch