312-39 · Question #40
You are working as a SOC analyst for a cloud-based service provider that relies on PostgreSQL databases to store critical customer data. During a security review, you discover that logs are not…
The correct answer is B. log_collector. In PostgreSQL, the configuration parameter that enables writing logs to files via the logging collector process is log_collector. When enabled, PostgreSQL can collect stderr output from backend processes and route it into log files, which is foundational for centralized log…
Question
You are working as a SOC analyst for a cloud-based service provider that relies on PostgreSQL databases to store critical customer data. During a security review, you discover that logs are not being generated for failed authentication attempts, slow queries, or database errors. This lack of visibility is making it difficult to detect threats and investigate suspicious activity. To ensure PostgreSQL captures and stores logs for centralized monitoring and forensic analysis, which configuration parameter should you enable?
Options
- Blog_collector
- Cloggingcollector
- Dlogging-collector (with space)
How the community answered
(31 responses)- B74% (23)
- C10% (3)
- D16% (5)
Explanation
In PostgreSQL, the configuration parameter that enables writing logs to files via the logging collector process is log_collector. When enabled, PostgreSQL can collect stderr output from backend processes and route it into log files, which is foundational for centralized log shipping and retention. From a SOC standpoint, turning on log collection is necessary but not sufficient: you typically also need to configure what gets logged (authentication failures, statement duration thresholds for slow queries, and error verbosity), define log line prefixes for consistent parsing, and set rotation/retention to meet operational and compliance needs. However, the question specifically asks which parameter should be enabled to ensure PostgreSQL captures and stores logs, and log_collector is the correct parameter name and casing. The other options include incorrect naming or formatting. Once enabled, the SOC team can forward PostgreSQL logs to the SIEM to correlate database activity with identity, endpoint, and network signals-critical for detecting brute force attempts, suspicious administrative actions, and anomalous query behavior.
Topics
Community Discussion
No community discussion yet for this question.