Skip to main content

More Info:

PostgreSQL Log Min Duration Statement Flag Should Be -1

Risk Level

Medium

Address

Security

Compliance Standards

CISGCP, CBP

Triage and Remediation

Remediation

Using Console

To remediate the PostgreSQL Log Min Duration Statement Flag misconfiguration in GCP using the GCP console, you can follow these steps:
  1. Log in to the GCP console and select the project where the PostgreSQL instance is located.
  2. In the navigation menu, go to SQL > PostgreSQL.
  3. Select the instance where the PostgreSQL Log Min Duration Statement Flag should be remediated.
  4. Click on the “Edit” button at the top of the page.
  5. Scroll down to the “Flags” section and look for the “log_min_duration_statement” flag.
  6. Change the value of the “log_min_duration_statement” flag to “-1”.
  7. Click the “Save” button to apply the changes.
  8. Verify that the PostgreSQL Log Min Duration Statement Flag has been successfully remediated by checking the PostgreSQL logs.
Note: It is important to understand the impact of changing this flag before making any changes to the configuration. The log_min_duration_statement flag determines the minimum duration of a SQL statement before it is logged, and setting it to -1 means that all statements will be logged. This can have a significant impact on the performance of the PostgreSQL instance and the amount of storage used for the logs.

To remediate the PostgreSQL Log Min Duration Statement Flag misconfiguration for GCP using GCP CLI, follow these steps:
  1. Open the Cloud Shell in your GCP console.
  2. Run the following command to authenticate your GCP account:
  1. Once you are authenticated, set the project where your PostgreSQL instance is located:
  1. Check the current value of the PostgreSQL Log Min Duration Statement Flag by running the following command:
  1. If the current value is not -1, update it by running the following command:
  1. Confirm the change by running the following command:
The output should show the updated value of -1 for the PostgreSQL Log Min Duration Statement Flag.That’s it! You have successfully remediated the PostgreSQL Log Min Duration Statement Flag misconfiguration for GCP using GCP CLI.
To remediate the PostgreSQL log_min_duration_statement flag misconfiguration in GCP using Python, follow these steps:
  1. Import the necessary libraries:
  1. Authenticate with the GCP account using service account credentials:
  1. Retrieve the current value of the log_min_duration_statement flag:
  1. If the current value is not -1, update the flag to -1:
Note: The ALTER SYSTEM SET command updates the flag in the PostgreSQL configuration file, so the change will persist even if the database is restarted.
  1. Restart the PostgreSQL service to apply the changes:
These steps should remediate the PostgreSQL log_min_duration_statement flag misconfiguration in GCP using Python.