PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days
Checks `logfiles.retention_days` on Azure Database for PostgreSQL Flexible Server. Log retention is governed by `log_retention_days`. The configuration passes when it is set and within 4-7 days.
Insufficient or disabled log retention limits the audit trail needed to detect brute-force, SQL injection, or insider misuse, impeding investigation. Excessive retention enlarges exposure if logs are accessed, risking sensitive query data leakage and policy violations.
What this control checks
logfiles.retention_days must be set to a value within 4-7 days on PostgreSQL flexible servers
Common pitfalls
Value outside 4-7 days fails the check
Configuration is assessed as set and within 4-7 days versus unset or outside this range.
Empty value is treated as 0 days
Configures logfiles.retention_days to at least 7 days for PostgreSQL flexible servers to ensure server logs are retained for sufficient time to support auditing and forensic investigations.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Configure logfiles.retention_days to at least 7 days for PostgreSQL flexible servers" (f5ed3f7a-cf5d-4ee6-9ede-b5d5192ccf81); Prowler check postgresql_flexible_server_log_retention_days_greater_3 (prowler azure --checks postgresql_flexible_server_log_retention_days_greater_3); PowerPipe control azure_compliance.control.postgres_flexible_server_log_retention_days_3.
Framework-specific interpretation
SOC 2: Mapped to CC7.2 (The entity monitors system components and the operation of those components for anomalies that are indicative of...) and CC7.3 (The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to...).
ISO/IEC 27001:2022: Mapped to A.8.15 (Logging).
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.f (apply logging to the management of access rights.), 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 2.1.2.h (continuously monitor the implementation of the risk treatment measures;) and 5 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
- A.8.15 Logging
- 2 Risk management policy
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
1 more clause
- 12 Asset management
- DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.
- OPS-06.01B Policies and instructions for at least daily backup and restore of cloud service customer data, cloud service derived data and cloud service provider data according to the sensitivity of the data are documented, communicated and provided in accordance with SP-01 regarding the...
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
- OPS-14.02B Log data is deleted if it is no longer required for the purpose for which it was collected.
- OPS-15.01AC On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them.
5 more clauses
- OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events.
- OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.
- PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the...
- SIM-03.06B All documents and evidence that provide details on security incidents related to the cloud service are archived in a way that could be used as evidence in court. Security mechanisms and processes for protecting all the information about security incidents related to the cloud service...
- SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident.
- 4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
- 4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
- 5.2.4 Ensure Server Parameter 'logfiles.retention_days' is greater than 3 days for PostgreSQL flexible Server
Related controls
- PostgreSQL servers should have 'Enforce SSL connection' enabled
- Azure subscriptions should have an Activity Log Alert configured for specific Administrative operations
- Data Lake Analytics accounts should have resource logs enabled
- Azure SQL databases should have long-term geo-redundant backup enabled
- Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
postgres_flexible_server_log_retention_days_3 - Powerpipe Control:
azure_compliance.control.postgres_flexible_server_log_retention_days_3 - Prowler Check:
postgresql_flexible_server_log_retention_days_greater_3 - Azure Policy Definition:
f5ed3f7a-cf5d-4ee6-9ede-b5d5192ccf81
Last reviewed: 2026-10-14