Rule: Database logging should be enabled

Database Logging Rule - FedRAMP Low Revision 4

Description:

Troubleshooting Steps:

2. 1.
   Verify the current state of logging: Check if database logging is already enabled or disabled. If already enabled, proceed with the configuration checks. If disabled, enable it according to the provided steps.
4. 2.
   Review database and system documentation: Understand the logging capabilities and requirements for the specific database technology in use.
6. 3.
   Check database configuration: Ensure that the necessary permissions and configurations are in place for enabling database logging.
8. 4.
   Review database error logs: Check for any error messages or warnings related to logging configuration. Address any issues found.

Necessary Codes:

Step-by-Step Guide for Remediation:

1. Identify the Database Technology:

2. Enable Database Logging:

For MySQL:

2. 1.
   Open the MySQL configuration file (usually located at

   /etc/my.cnf

   or

   /etc/mysql/my.cnf

   ).
4. 2.
   Locate the

   [mysqld]

   section.
6. 3.
   Add or modify the following line:

   general_log = 1

   .
8. 4.
   Save the file and restart the MySQL service.

For PostgreSQL:

2. 1.
   Open the PostgreSQL configuration file (usually located at

   /var/lib/pgsql/VERSION_NUMBER/data/postgresql.conf

   ).
4. 2.
   Locate the

   logging_collector

   parameter and set it to

   on

   .
6. 3.
   Save the file and restart the PostgreSQL service.

For Oracle:

2. 1.
   Connect to the Oracle database as a privileged user.
4. 2.
   Execute the following SQL command to enable logging:

   ALTER SYSTEM SET audit_trail=db, extended SCOPE=spfile;

   .
6. 3.
   Restart the Oracle service for the changes to take effect.

For SQL Server:

2. 1.
   Connect to the SQL Server instance using SQL Server Management Studio (SSMS).
4. 2.
   Expand the "Management" node, right-click on "SQL Server Logs," and select "Configure".
6. 3.
   In the "Configure SQL Server Error Logs" dialog, select the desired options for logging, such as the retention period and the maximum log size.
8. 4.
   Click "OK" to save the changes.

3. Verify Logging Status:

For MySQL:

2. 1.
   Connect to the MySQL database using a client (e.g., MySQL Workbench, command-line interface).
4. 2.
   Execute the following SQL command:

   SHOW VARIABLES LIKE '%general_log%';

   .
6. 3.
   Check if the value of the

   general_log

   variable is set to

   ON

   .

For PostgreSQL:

2. 1.
   Connect to the PostgreSQL database using a client (e.g., pgAdmin, psql command-line).
4. 2.
   Run the following SQL query:

   SELECT * FROM pg_settings WHERE name = 'logging_collector';

   .
6. 3.
   Verify that the value of the

   logging_collector

   parameter is

   on

   .

For Oracle:

2. 1.
   Connect to the Oracle database as a privileged user.
4. 2.
   Execute the following SQL command:

   SELECT VALUE FROM V$PARAMETER WHERE NAME = 'audit_trail';

   .
6. 3.
   Ensure that the output is

   DB

   .

For SQL Server:

2. 1.
   In SSMS, expand the "Management" node, right-click on "SQL Server Logs," and select "View SQL Server Log."
4. 2.
   Review the log entries to verify that logging is active and no errors are reported.

Conclusion: