> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable LOG_DURATION Parameter for PostgreSQL Servers

### More Info:

Ensure that log\_duration server parameter is enabled for all PostgreSQL database servers created in your Microsoft Azure cloud account. Once enabled, the log\_duration parameter allows recording the duration of each completed PostgreSQL statement. Only users with administrative privileges can change this setting within Azure PostgreSQL server configuration. For database clients using extended query protocol, the duration of the Parse, Bind, and Execute steps is logged independently.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* HITRUST CSF
* NIST CSF
* PCI
* SOC2

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "LOG\_DURATION" parameter misconfiguration for PostgreSQL Servers in Azure, you can follow the below steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the PostgreSQL server for which you want to enable the "LOG\_DURATION" parameter.
        3. Click on the "Configuration" tab from the left-hand side menu.
        4. Scroll down to the "Parameters" section and search for the "log\_duration" parameter.
        5. If the "log\_duration" parameter is not present, click on the "+ Add parameter" button and add the parameter.
        6. Set the value of the "log\_duration" parameter to "on" to enable it.
        7. Click on the "Save" button to save the changes.

        After following the above steps, the "LOG\_DURATION" parameter will be enabled for the PostgreSQL server in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of enabling the "LOG\_DURATION" parameter for PostgreSQL servers in AZURE using AZURE CLI, you can follow the below steps:

        1. Open the AZURE CLI and log in to your AZURE account.

        2. Run the below command to get the list of all the PostgreSQL servers in your subscription:

           ```
           az postgres server list
           ```

        3. Select the PostgreSQL server for which you want to enable the "LOG\_DURATION" parameter and note down its resource group name and server name.

        4. Run the below command to enable the "LOG\_DURATION" parameter for the selected PostgreSQL server:

           ```
           az postgres server configuration set --resource-group <resource_group_name> --server-name <server_name> --name log_duration --value on
           ```

           Replace `<resource_group_name>` and `<server_name>` with the actual values of the resource group name and server name noted down in step 3.

        5. Verify that the "LOG\_DURATION" parameter is enabled for the PostgreSQL server by running the below command:

           ```
           az postgres server configuration list --resource-group <resource_group_name> --server-name <server_name> --query "[?name=='log_duration']"
           ```

           If the output shows the value of "value" parameter as "on", then the "LOG\_DURATION" parameter is enabled for the PostgreSQL server.

        By following the above steps, you can remediate the misconfiguration of enabling the "LOG\_DURATION" parameter for PostgreSQL servers in AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To enable the "LOG\_DURATION" parameter for PostgreSQL servers in Azure using python, you can follow the below steps:

        1. Import the necessary libraries:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.rdbms.postgresql import PostgreSQLManagementClient
        ```

        2. Set the credentials for authentication:

        ```python theme={null}
        TENANT_ID = '<your tenant id>'
        CLIENT = '<your client id>'
        KEY = '<your client secret>'
        SUBSCRIPTION_ID = '<your subscription id>'

        credentials = ServicePrincipalCredentials(
            client_id=CLIENT,
            secret=KEY,
            tenant=TENANT_ID
        )
        ```

        3. Create a PostgreSQL management client object:

        ```python theme={null}
        client = PostgreSQLManagementClient(
            credentials=credentials,
            subscription_id=SUBSCRIPTION_ID
        )
        ```

        4. Get the PostgreSQL server you want to enable the "LOG\_DURATION" parameter for:

        ```python theme={null}
        RESOURCE_GROUP_NAME = '<your resource group name>'
        SERVER_NAME = '<your server name>'

        server = client.servers.get(
            resource_group_name=RESOURCE_GROUP_NAME,
            server_name=SERVER_NAME
        )
        ```

        5. Update the server configuration to enable the "LOG\_DURATION" parameter:

        ```python theme={null}
        CONFIGURATION_NAME = 'postgresql.conf'
        CONFIGURATION_VALUE = 'log_duration = on'

        parameters = {
            'name': CONFIGURATION_NAME,
            'value': CONFIGURATION_VALUE
        }

        client.configurations.create_or_update(
            resource_group_name=RESOURCE_GROUP_NAME,
            server_name=SERVER_NAME,
            configuration_name=CONFIGURATION_NAME,
            parameters=parameters
        )
        ```

        6. Verify that the configuration has been updated:

        ```python theme={null}
        configuration = client.configurations.get(
            resource_group_name=RESOURCE_GROUP_NAME,
            server_name=SERVER_NAME,
            configuration_name=CONFIGURATION_NAME
        )

        print(configuration.value)
        ```

        This should enable the "LOG\_DURATION" parameter for the PostgreSQL server in Azure.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_postgresql_server" "POSTGRESQL_SERVER" {
          name                = "POSTGRESQL_SERVER_NAME"          # replace with your server name
          location            = "AZURE_REGION"                    # e.g. "eastus"
          resource_group_name = "RESOURCE_GROUP_NAME"             # replace with your resource group
          sku_name            = "SKU_NAME"                        # e.g. "GP_Gen5_2"
          version             = "11"
          storage_mb          = 5120
          administrator_login          = "ADMIN_USERNAME"
          administrator_login_password = "ADMIN_PASSWORD"

          auto_grow_enabled           = true
          backup_retention_days       = 7
          geo_redundant_backup_enabled = false
          ssl_enforcement_enabled     = true
        }

        resource "azurerm_postgresql_configuration" "log_duration" {
          name                = "log_duration"
          resource_group_name = azurerm_postgresql_server.POSTGRESQL_SERVER.resource_group_name
          server_name         = azurerm_postgresql_server.POSTGRESQL_SERVER.name
          value               = "on"
        }
        ```

        This change does not replace the PostgreSQL server; it updates a configuration setting in place (a short restart may occur depending on Azure behavior, but Terraform will not recreate the server).

        After updating your Terraform, `terraform plan` should show creation (or update) of `azurerm_postgresql_configuration.log_duration` with `value` changing from `"off"` (or unset) to `"on"` and no `destroy`/`create` for the `azurerm_postgresql_server`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>