> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PostgreSQL Log Parser Stats Flag Should Be Off

### More Info:

Ensure that the log\_parser\_stats database flag for a Cloud SQL PostgreSQL instance is set to off.

### Risk Level

Low

### Address

Reliability, Security

### Compliance Standards

CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the PostgreSQL Log Parser Stats Flag Should Be Off misconfiguration in GCP using the GCP console, follow these steps:

        1. Open the GCP Console and navigate to the Cloud SQL instances page.
        2. Click on the name of the instance that has the PostgreSQL Log Parser Stats Flag Should Be Off misconfiguration.
        3. In the left-hand menu, click on the Configuration tab.
        4. Scroll down to the Flags section and click on Edit.
        5. In the Flags editor, search for the log\_parser\_stats flag.
        6. If the log\_parser\_stats flag is set to ON, toggle it to OFF.
        7. Click Save to apply the changes.

        Once the changes are saved, the PostgreSQL Log Parser Stats Flag will be turned off and the misconfiguration will be remediated.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the PostgreSQL Log Parser Stats Flag Should Be Off misconfiguration in GCP using GCP CLI, you can follow these steps:

        1. Open the Cloud Shell in the GCP console.

        2. Run the following command to list all the Cloud SQL instances in your project:

           ```
           gcloud sql instances list
           ```

        3. Identify the instance that has the PostgreSQL Log Parser Stats Flag Should Be Off misconfiguration.

        4. Run the following command to update the instance settings:

           ```
           gcloud sql instances patch [INSTANCE_NAME] --database-flags log_parser_stats=off
           ```

           Replace \[INSTANCE\_NAME] with the name of the instance that you identified in step 3.

        5. Verify that the log\_parser\_stats flag is set to off by running the following command:

           ```
           gcloud sql instances describe [INSTANCE_NAME]
           ```

           Replace \[INSTANCE\_NAME] with the name of the instance that you identified in step 3.

           Look for the following line in the output:

           ```
           databaseFlags:
             log_parser_stats: off
           ```

           If you see this line, the misconfiguration has been remediated successfully.

        That's it! You have successfully remediated the PostgreSQL Log Parser Stats Flag Should Be Off misconfiguration for the specified GCP instance using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the PostgreSQL Log Parser Stats Flag Should Be Off misconfiguration in GCP using python, follow these steps:

        1. Install the `google-cloud-secret-manager` and `google-cloud-logging` python packages using pip.

           ```
           pip install google-cloud-secret-manager google-cloud-logging
           ```

        2. Import the necessary libraries.

           ```python theme={null}
           from google.cloud import secretmanager_v1beta1
           from google.cloud import logging_v2
           ```

        3. Retrieve the value of the `POSTGRES_STATS_FLAG` secret from Google Secret Manager.

           ```python theme={null}
           client = secretmanager_v1beta1.SecretManagerServiceClient()
           name = client.secret_version_path('<PROJECT_ID>', '<SECRET_NAME>', '<SECRET_VERSION>')
           response = client.access_secret_version(name)
           postgres_stats_flag = response.payload.data.decode('UTF-8')
           ```

           Replace `<PROJECT_ID>`, `<SECRET_NAME>`, and `<SECRET_VERSION>` with the appropriate values.

        4. Update the log sink for PostgreSQL to disable the log parser stats flag.

           ```python theme={null}
           client = logging_v2.LoggingServiceV2Client()
           parent = client.project_path('<PROJECT_ID>')
           resource = {
               "type": "gce_instance",
               "labels": {
                   "instance_id": "<INSTANCE_ID>",
                   "zone": "<ZONE>"
               }
           }
           filter = 'resource.type="gce_instance" AND resource.labels.instance_id="<INSTANCE_ID>" AND logName="projects/<PROJECT_ID>/logs/postgresql.log"'
           sinks = client.list_sinks(parent)
           for sink in sinks:
               if sink.filter == filter:
                   sink.destination.update_gcs_bucket = None
                   sink.destination.disable_log_entry_types = ["LOG_ENTRY_TYPE_UNSPECIFIED", "PROTO_PAYLOAD"]
                   sink.destination.enable_log_entry_types = []
                   sink.filter = 'resource.type="gce_instance" AND resource.labels.instance_id="<INSTANCE_ID>" AND logName="projects/<PROJECT_ID>/logs/postgresql.log" AND NOT jsonPayload.message:("LOG: statement stats:")'
                   client.update_sink(sink)
                   break
           ```

           Replace `<PROJECT_ID>`, `<INSTANCE_ID>`, and `<ZONE>` with the appropriate values.

        5. Verify that the log sink has been updated successfully.

           ```
           gcloud logging sinks describe <SINK_NAME> --project=<PROJECT_ID>
           ```

           Replace `<SINK_NAME>` and `<PROJECT_ID>` with the appropriate values.

        That's it! The PostgreSQL Log Parser Stats Flag Should Be Off misconfiguration has been remediated for GCP using python.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>