​
More Info:

The log_parser_stats flag enables a crude profiling method for logging parser performance statistics which even though can be useful for troubleshooting, it may increase the amount of logs significantly and have performance overhead.

​
Risk Level

Low

​
Address

Security

​
Compliance Standards

CBP

​
Triage and Remediation

​
Remediation

Using Console

To remediate the “PostgreSQL Log Temp Files Flag Should Be 0” misconfiguration in GCP using the GCP console, follow the steps below:
  1. Open the GCP Console and navigate to the Cloud SQL instances page.
  2. Select the instance that you want to remediate.
  3. In the instance details page, click on the “Edit” button at the top of the page.
  4. Scroll down to the “Flags” section and click on the “Add item” button.
  5. In the “Flag name” field, enter “log_temp_files” (without the quotes).
  6. In the “Flag value” field, enter “0” (without the quotes).
  7. Click on the “Save” button at the bottom of the page.
Once you have completed these steps, the “log_temp_files” flag will be set to 0, which will remediate the misconfiguration.

​

To remediate the PostgreSQL log temp files flag misconfiguration for GCP using GCP CLI, follow these steps:
  1. Open the GCP Cloud Shell.
  2. Connect to your instance using the following command: 
    gcloud compute ssh [INSTANCE_NAME] --zone [ZONE]
    Replace [INSTANCE_NAME] and [ZONE] with the name and zone of your instance.
  3. Switch to the PostgreSQL user: 
    sudo su - postgres
  4. Open the postgresql.conf file using a text editor: 
    vi /etc/postgresql/12/main/postgresql.conf
    Note: Replace 12 with the version of PostgreSQL you have installed.
  5. Search for the log_temp_files flag using the / command and update the value to 0.
  6. Save the changes and exit the text editor.
  7. Restart the PostgreSQL service: 
    systemctl restart postgresql
  8. Exit the PostgreSQL user session: 
    exit
  9. Disconnect from the instance: 
    exit
The PostgreSQL log temp files flag should now be remediated for your GCP instance.
To remediate the PostgreSQL log temp files flag misconfiguration in GCP using Python, follow these steps:
  1. First, you need to authenticate with your GCP project using the Google Cloud SDK. You can do this by running the following command: 
    gcloud auth login
  2. Next, you need to install the google-cloud-secret-manager library, which will allow you to access the PostgreSQL configuration secrets stored in GCP Secret Manager. You can install this library using pip: 
    pip install google-cloud-secret-manager
  3. Once you have authenticated and installed the necessary libraries, you can use the following Python code to retrieve the current value of the log_temp_files flag: 
    from google.cloud import secretmanager

# Replace [PROJECT_ID] and [SECRET_ID] with your GCP project ID and PostgreSQL configuration secret ID, respectively.
project_id = '[PROJECT_ID]'
secret_id = '[SECRET_ID]'

# Create a Secret Manager client.
client = secretmanager.SecretManagerServiceClient()

# Retrieve the PostgreSQL configuration secret.
name = f"projects/{project_id}/secrets/{secret_id}/versions/latest"
response = client.access_secret_version(name=name)
config = response.payload.data.decode('UTF-8')

# Parse the PostgreSQL configuration and retrieve the value of the log_temp_files flag.
for line in config.split('\n'):
    if line.startswith('log_temp_files'):
        current_value = line.split('=')[1].strip()
        break
  4. If the current value of the log_temp_files flag is not 0, you can use the following Python code to update the PostgreSQL configuration and set the flag to 0: 
    from google.cloud import secretmanager

# Replace [PROJECT_ID] and [SECRET_ID] with your GCP project ID and PostgreSQL configuration secret ID, respectively.
project_id = '[PROJECT_ID]'
secret_id = '[SECRET_ID]'

# Create a Secret Manager client.
client = secretmanager.SecretManagerServiceClient()

# Retrieve the PostgreSQL configuration secret.
name = f"projects/{project_id}/secrets/{secret_id}/versions/latest"
response = client.access_secret_version(name=name)
config = response.payload.data.decode('UTF-8')

# Update the PostgreSQL configuration and set the log_temp_files flag to 0.
new_config = []
for line in config.split('\n'):
    if line.startswith('log_temp_files'):
        new_config.append('log_temp_files = 0')
    else:
        new_config.append(line)
new_config = '\n'.join(new_config)

# Create a new version of the PostgreSQL configuration secret with the updated configuration.
parent = f"projects/{project_id}/secrets/{secret_id}"
payload = {'data': new_config.encode('UTF-8')}
response = client.add_secret_version(parent=parent, payload=payload)
  5. Finally, you can verify that the log_temp_files flag has been set to 0 by running the first block of code again and checking the value of current_value. If the value is 0, the remediation was successful.