> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit postgressql enable log duration remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "LOG\_DURATION" parameter misconfiguration for PostgreSQL Servers in Azure, you can follow the below steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the PostgreSQL server for which you want to enable the "LOG\_DURATION" parameter.
        3. Click on the "Configuration" tab from the left-hand side menu.
        4. Scroll down to the "Parameters" section and search for the "log\_duration" parameter.
        5. If the "log\_duration" parameter is not present, click on the "+ Add parameter" button and add the parameter.
        6. Set the value of the "log\_duration" parameter to "on" to enable it.
        7. Click on the "Save" button to save the changes.

        After following the above steps, the "LOG\_DURATION" parameter will be enabled for the PostgreSQL server in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of enabling the "LOG\_DURATION" parameter for PostgreSQL servers in AZURE using AZURE CLI, you can follow the below steps:

        1. Open the AZURE CLI and log in to your AZURE account.

        2. Run the below command to get the list of all the PostgreSQL servers in your subscription:

           ```
           az postgres server list
           ```

        3. Select the PostgreSQL server for which you want to enable the "LOG\_DURATION" parameter and note down its resource group name and server name.

        4. Run the below command to enable the "LOG\_DURATION" parameter for the selected PostgreSQL server:

           ```
           az postgres server configuration set --resource-group <resource_group_name> --server-name <server_name> --name log_duration --value on
           ```

           Replace `<resource_group_name>` and `<server_name>` with the actual values of the resource group name and server name noted down in step 3.

        5. Verify that the "LOG\_DURATION" parameter is enabled for the PostgreSQL server by running the below command:

           ```
           az postgres server configuration list --resource-group <resource_group_name> --server-name <server_name> --query "[?name=='log_duration']"
           ```

           If the output shows the value of "value" parameter as "on", then the "LOG\_DURATION" parameter is enabled for the PostgreSQL server.

        By following the above steps, you can remediate the misconfiguration of enabling the "LOG\_DURATION" parameter for PostgreSQL servers in AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To enable the "LOG\_DURATION" parameter for PostgreSQL servers in Azure using python, you can follow the below steps:

        1. Import the necessary libraries:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.rdbms.postgresql import PostgreSQLManagementClient
        ```

        2. Set the credentials for authentication:

        ```python theme={null}
        TENANT_ID = '<your tenant id>'
        CLIENT = '<your client id>'
        KEY = '<your client secret>'
        SUBSCRIPTION_ID = '<your subscription id>'

        credentials = ServicePrincipalCredentials(
            client_id=CLIENT,
            secret=KEY,
            tenant=TENANT_ID
        )
        ```

        3. Create a PostgreSQL management client object:

        ```python theme={null}
        client = PostgreSQLManagementClient(
            credentials=credentials,
            subscription_id=SUBSCRIPTION_ID
        )
        ```

        4. Get the PostgreSQL server you want to enable the "LOG\_DURATION" parameter for:

        ```python theme={null}
        RESOURCE_GROUP_NAME = '<your resource group name>'
        SERVER_NAME = '<your server name>'

        server = client.servers.get(
            resource_group_name=RESOURCE_GROUP_NAME,
            server_name=SERVER_NAME
        )
        ```

        5. Update the server configuration to enable the "LOG\_DURATION" parameter:

        ```python theme={null}
        CONFIGURATION_NAME = 'postgresql.conf'
        CONFIGURATION_VALUE = 'log_duration = on'

        parameters = {
            'name': CONFIGURATION_NAME,
            'value': CONFIGURATION_VALUE
        }

        client.configurations.create_or_update(
            resource_group_name=RESOURCE_GROUP_NAME,
            server_name=SERVER_NAME,
            configuration_name=CONFIGURATION_NAME,
            parameters=parameters
        )
        ```

        6. Verify that the configuration has been updated:

        ```python theme={null}
        configuration = client.configurations.get(
            resource_group_name=RESOURCE_GROUP_NAME,
            server_name=SERVER_NAME,
            configuration_name=CONFIGURATION_NAME
        )

        print(configuration.value)
        ```

        This should enable the "LOG\_DURATION" parameter for the PostgreSQL server in Azure.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_postgresql_server" "POSTGRESQL_SERVER" {
          name                = "POSTGRESQL_SERVER_NAME"          # replace with your server name
          location            = "AZURE_REGION"                    # e.g. "eastus"
          resource_group_name = "RESOURCE_GROUP_NAME"             # replace with your resource group
          sku_name            = "SKU_NAME"                        # e.g. "GP_Gen5_2"
          version             = "11"
          storage_mb          = 5120
          administrator_login          = "ADMIN_USERNAME"
          administrator_login_password = "ADMIN_PASSWORD"

          auto_grow_enabled           = true
          backup_retention_days       = 7
          geo_redundant_backup_enabled = false
          ssl_enforcement_enabled     = true
        }

        resource "azurerm_postgresql_configuration" "log_duration" {
          name                = "log_duration"
          resource_group_name = azurerm_postgresql_server.POSTGRESQL_SERVER.resource_group_name
          server_name         = azurerm_postgresql_server.POSTGRESQL_SERVER.name
          value               = "on"
        }
        ```

        This change does not replace the PostgreSQL server; it updates a configuration setting in place (a short restart may occur depending on Azure behavior, but Terraform will not recreate the server).

        After updating your Terraform, `terraform plan` should show creation (or update) of `azurerm_postgresql_configuration.log_duration` with `value` changing from `"off"` (or unset) to `"on"` and no `destroy`/`create` for the `azurerm_postgresql_server`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>