Database logging rule

Database Logging for CISA Cyber Essentials

Rule Description

Troubleshooting Steps

2. 1.

   Check Database Logging Status: Verify the current status of database logging in the system. This can be done by accessing the database management system's administrative interface or by executing relevant SQL queries.

4. 2.

   Review System Logs: Inspect system logs to identify any entries related to database logging issues. Look for error messages, warnings, or indications of the logging feature being disabled or misconfigured.

6. 3.

   Check Database Configuration: Ensure that the database settings are properly configured to enable logging. Review the database documentation or consult with a database administrator to understand the correct configuration parameters.

8. 4.

   Verify Database User Permissions: Make sure that the user account used for accessing the database has the necessary permissions to enable and manage database logging. Grant the required privileges if necessary.

10. 5.

    Restart Database Service: In some cases, enabling database logging may require restarting the database service to enforce the new configuration. Check the database documentation for the appropriate steps to restart the service.

12. 6.

    Test Logging Functionality: Validate that logging is functioning as expected by performing test operations on the database and verifying the corresponding logs. This can include creating, modifying, or deleting database records and ensuring the actions are logged appropriately.

Code Samples

MySQL

[mysqld]
...
general_log=1
general_log_file= /var/log/mysql/mysql.log

PostgreSQL

postgresql.conf

logging_collector = on
log_destination = 'stderr'
log_directory = 'pg_log'
log_filename = 'postgresql-%a.log'
log_statement = 'all'

SQL Server

EXEC sys.sp_cdc_enable_db;

Remediation Steps

2. 1.

   Identify the Database Management System: Determine the specific database management system used for CISA Cyber Essentials. This could be MySQL, PostgreSQL, SQL Server, or another commonly used system.

4. 2.

   Access the Database Administration Interface: Connect to the administrative interface or tool provided by the chosen database management system. This could be the command-line interface, a graphical user interface, or a web interface.

6. 3.

   Locate the Configuration File: Find and open the configuration file for the database management system. The file is usually named

   my.cnf

   or

   my.ini

   for MySQL,

   postgresql.conf

   for PostgreSQL, or can be accessed through the management tool for SQL Server.

8. 4.

   Apply the Configuration Changes: Add the appropriate configuration settings mentioned earlier in the code samples for the respective database management system. Modify the file with the necessary changes, save it, and close the editor.

10. 5.

    Restart the Database Service: If required, restart the database service to apply the new logging configuration. Consult the documentation of the database management system for the specific command to restart the service.

12. 6.

    Verify Database Logging: Verify that database logging is functioning correctly by performing test operations on the database. Ensure that the operations are logged as expected and review the log files to confirm the presence of relevant log entries.