Rule: Database logging should be enabled

Rule Description: Database logging should be enabled for NIST 800-53 Revision 5

Description:

Potential Benefits:

Troubleshooting Steps:

2. 1.
   Verify database version: Ensure that your database version is compatible with the logging feature. Older versions may have limitations or lack specific logging features.
4. 2.
   Check database permissions: Confirm that the database user has sufficient privileges to enable logging. The user should have the necessary permissions to modify logging settings.
6. 3.
   Review logging configuration: Double-check the logging configuration settings to ensure they are correctly enabled. Pay attention to the log level and destination configurations.
8. 4.
   Restart the database service: Restarting the database service can sometimes resolve logging-related issues. Make sure to plan any maintenance activities accordingly and ensure minimal impact on production environments.

Necessary Codes:

MySQL/MariaDB:

2. 1.
   Open the MySQL/MariaDB configuration file (usually located at

   /etc/mysql/my.cnf

   or

   /etc/my.cnf

   ) using a text editor with administrative privileges.
4. 2.
   Locate the

   [mysqld]

   section in the configuration file.
6. 3.
   Add the following line to enable general query logs:

   general_log = 1

8. 4.
   If required, specify the log file name and path using the

   general_log_file

   parameter. For example:

   general_log_file = /var/log/mysql/mysql.log

10. 5.
    Save and close the configuration file.
12. 6.
    Restart the MySQL/MariaDB service to apply the changes.

PostgreSQL:

2. 1.
   Open the PostgreSQL configuration file (

   postgresql.conf

   ) using a text editor with administrative privileges. The configuration file is typically located in the data directory of the PostgreSQL installation.
4. 2.
   Locate the

   logging_collector

   parameter and set it to

   on

   .
6. 3.
   If necessary, modify the

   log_directory

   parameter to specify the desired log directory.
8. 4.
   Specify the log output format using the

   log_destination

   parameter. Common options are

   syslog

   or

   stderr

   .
10. 5.
    Save and close the configuration file.
12. 6.
    Restart the PostgreSQL service for the changes to take effect.

Remediation Steps:

2. 1.
   Identify the database system in use (e.g., MySQL, MariaDB, PostgreSQL, Oracle, etc.).
4. 2.
   Determine the appropriate configuration file for the database system.
6. 3.
   Open the relevant configuration file using a text editor with administrative privileges.
8. 4.
   Locate the logging-related configuration options in the file.
10. 5.
    Modify the necessary configuration parameters to enable database logging.
12. 6.
    Save the changes to the configuration file.
14. 7.
    Restart the database service to apply the logging settings.
16. 8.
    Verify that logging is working correctly by reviewing the log files and ensuring the desired logs are being generated.