cis-azure-database-6-6

name	cis-azure-database-6.6
description	Ensure server parameter 'logfiles.retention_days' is greater than 3 days for PostgreSQL server
category	cis-azure-database
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","postgresql","database"]
cis_id	6.6
cis_benchmark	CIS Microsoft Azure Database Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.6 Ensure server parameter 'logfiles.retention_days' is greater than 3 days for PostgreSQL server (Automated)

Profile Applicability

• Level 1

Description

Ensure logfiles.retention_days on PostgreSQL flexible servers is set to an appropriate value.

Rationale

Configuring logfiles.retention_days determines the duration in days that Azure Database for PostgreSQL retains log files. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.

Impact

Configuring this setting will result in logs being retained for the specified number of days. If this is configured on a high traffic server, the log may grow quickly to occupy a large amount of disk space. In this case you may want to set this to a lower number.

Audit Procedure

Audit from Azure Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to Azure Database for PostgreSQL servers.
3. For each server, under Settings, click Server parameters.
4. In the filter bar, type logfiles.retention_days.
5. Ensure that the VALUE is between 4 and 7 (inclusive).

Audit from Azure CLI

Ensure logfiles.retention_days value is greater than 3:

az postgres flexible-server parameter show --resource-group <resourceGroup> --server-name <serverName> --name logfiles.retention_days

Audit from PowerShell

Ensure logfiles.retention_days value is greater than 3:

Get-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name logfiles.retention_days

Expected Result

The logfiles.retention_days value should be between 4 and 7 (inclusive).

Remediation

Remediate from Azure Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to Azure Database for PostgreSQL servers.
3. For each server, under Settings, click Server parameters.
4. In the filter bar, type logfiles.retention_days.