XEIZE
/Vulnerability documentation/IaC/Ansible/Azure/PostgreSQL duration logging needs review

PostgreSQL duration logging needs review

PostgreSQL duration logs provide evidence for investigating slow operations and performance problems.

Description

log_duration records how long completed SQL statements take. Disabling it removes those records, but separate slow-query logging or performance tools may still provide timing information. Enabling log_duration alone does not automatically log the SQL text.

Potential impact

  • Missing timing data can make performance degradation harder to investigate.
  • Without suitable alternative measurements, comparing query optimizations may be difficult.

Remediation

  • Set log_duration to on in the current service when all statement durations are needed.
  • If only slow statements are needed, consider a suitable log_min_duration_statement threshold.
  • Measure log volume and performance impact. If SQL text is also logged, protect sensitive information and restrict log access.

Examples

The first excerpt targets Single Server, which retired on March 28, 2025. The second applies to an existing Flexible Server using azure.azcollection 3.18.0 or later.

Before

yaml
- name: PostgreSQL 설정 변경
  azure.azcollection.azure_rm_postgresqlconfiguration:
    resource_group: myResourceGroup
    server_name: myServer
    name: log_duration
    value: "off"

Duration logging through log_duration is disabled. This does not disable other performance measurement tools.

After

yaml
- name: PostgreSQL 설정 변경
  azure.azcollection.azure_rm_postgresqlflexibleconfiguration:
    resource_group: myResourceGroup
    server_name: myServer
    name: log_duration
    value: "on"

Durations of completed statements are logged. Check record volume and collection costs, and configure the required retention.

References

XEIZE DocumentationTechnical support