# 6.2.2 Ensure That the ‘Log_connections’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘On’ (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233033-6-2-2-ensure-that-the-log-connections-database-flag-for-cloud-sql-postgresql-instance-is-set-to-on - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: - Level 1 Description: The log\_connections database flag, when enabled, ensures that each attempted connection to the PostgreSQL server is logged, including successful client authentication. This setting is essential for monitoring and troubleshooting connection activity. Note that this parameter cannot be altered once a session starts. Rationale: By default, PostgreSQL does not log connection attempts. Enabling log\_connections creates log entries for every attempted connection and successful authentication. This information is invaluable for identifying unusual connection attempts, diagnosing connectivity issues, and enhancing the overall security of the database instance. Impact: - Enabling logging will result in an increase in storage usage over time. - Mismanaged logs can lead to increased storage costs. - Applying changes to database flags via the command line may reset any omitted flags to their default values, which can cause unintended disruptions or instance restarts. Therefore, it is recommended to make these changes during periods of low usage. Default Value: By default, the log\_connections flag is set to off. Audit Steps: #### Using Google Cloud Console: 1. Go to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.               ![](https://support.icompaas.com/assets/kb/3ef356ab85a164a1.png) 2. Select the desired PostgreSQL instance to open its Instance Overview page.            ![](https://support.icompaas.com/assets/kb/5858f78469047181.png) 3. Locate the Configuration card.                           ![](https://support.icompaas.com/assets/kb/d5e4c1fa1ce7fea1.png) 4. Check the value of the log\_connections flag under the Database Flags section. Ensure the value is set to on.               ![](https://support.icompaas.com/assets/kb/a3e81fef54aa86b6.png) #### Using Google Cloud CLI: Use the following command to check the value of the log\_connections flag for all PostgreSQL instances: gcloud sql instances describe \[INSTANCE\_NAME\] --format=json | jq '.settings.databaseFlags\[\] | select(.name=="log\_connections")|.value' 1. The output should display on for the flag. Remediation Steps: #### Using Google Cloud Console: 1. Navigate to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                       ![](https://support.icompaas.com/assets/kb/0664b42a57b6e981.png) 2. Select the PostgreSQL instance where the flag needs to be updated.                           ![](https://support.icompaas.com/assets/kb/37553e03f0770e53.png) 3. Click Edit.       ![](https://support.icompaas.com/assets/kb/e0ec5023ee246a9e.png) 4. Scroll to the Flags section and click Add a Database Flag.                      ![](https://support.icompaas.com/assets/kb/0ba3f0ee06ad833d.png) 5. Select the log\_connections flag from the dropdown and set its value to on.                   ![](https://support.icompaas.com/assets/kb/ab55dda794332cc2.png) 6. Click Save.                         ![](https://support.icompaas.com/assets/kb/65028e1cfb6bd090.png) 7. Confirm the changes under the Database Flags section on the Overview page.                           ![](https://support.icompaas.com/assets/kb/12edaa98b96564f9.png) #### Using Google Cloud CLI: Set the log\_connections flag for each PostgreSQL instance using the following command: gcloud sql instances patch \[INSTANCE\_NAME\] --database-flags log\_connections=on 1. Note: This command will overwrite all previously set flags. To retain existing flags, include them explicitly in the command. ### Backout Plan: 1. Revert the Flag to Off: - If needed, revert the log\_connections flag to off to stop logging connections. #### **Using Google Cloud Console:** - Navigate to the Cloud SQL Instances page. - Select the PostgreSQL instance to edit. - Click Edit, scroll to the Flags section, and remove or set the log\_connections flag to off. - Save and restart the instance. #### Using Google Cloud CLI gcloud sql instances patch \[INSTANCE\_NAME\] --database-flags log\_connections=off - Replace \[INSTANCE\_NAME\] with the actual PostgreSQL instance name. - Restart the instance for the changes to take effect References: 1. [Google Cloud SQL Database Flags Documentation](https://cloud.google.com/sql/docs/postgres/flags) 2. [PostgreSQL Documentation on Runtime Configuration Logging](https://www.postgresql.org/docs/9.6/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHAT) Additional Information: - Configuring this flag does not require restarting the Cloud SQL instance. - **Certain flag settings may impact instance availability and stability. Refer to [Operational Guidelines](https://cloud.google.com/sql/docs/postgres/flags) for more details.** - **Mismanaged logs can lead to excessive storage usage; ensure proper log rotation and retention policies are in place.** **CIS Controls:**

Control

Description

IG 1

IG 2

IG 3

8.5 Collect Detailed Audit Logs

Configure detailed audit logs to capture information such as event sources, timestamps, user data, and other elements for forensic analysis.

✅

✅


6.3 Enable Detailed Logging

Enable logging to capture detailed system information, including user and source details, to assist with investigations and troubleshooting.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.