| name | cis-gcp-foundations-6.2.1 |
| description | Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","cloud-sql","postgresql"] |
| cis_id | 6.2.1 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
6.2.1 Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter (Automated)
Profile Applicability
Description
The log_error_verbosity flag controls the verbosity/details of messages logged. Valid values are:
TERSE excludes the logging of DETAIL, HINT, QUERY, and CONTEXT error information.
VERBOSE output includes the SQLSTATE error code, source code file name, function name, and line number that generated the error.
Ensure an appropriate value is set to 'DEFAULT' or stricter.
Rationale
Auditing helps in troubleshooting operational problems and also permits forensic analysis. If log_error_verbosity is not set to the correct value, too many details or too few details may be logged. This flag should be configured with a value of 'DEFAULT' or stricter. This recommendation is applicable to PostgreSQL database instances.
Impact
Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.
Audit
From Google Cloud Console
- Go to the Cloud SQL Instances page in the Google Cloud Console by visiting https://console.cloud.google.com/sql/instances.
- Select the instance to open its
Instance Overview page
- Go to
Configuration card
- Under
Database flags, check the value of log_error_verbosity flag is set to 'DEFAULT' or stricter.
From Google Cloud CLI
- Use the below command for every Cloud SQL PostgreSQL database instance to verify the value of
log_error_verbosity
gcloud sql instances describe [INSTANCE_NAME] --format=json | jq '.settings.databaseFlags[] | select(.name=="log_error_verbosity")|.value'
