# 6.2.3 Ensure That the ‘Log_disconnections’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘On’ (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233034-6-2-3-ensure-that-the-log-disconnections-database-flag-for-cloud-sql-postgresql-instance-is-set-to- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: - Level 1 Description: The log\_disconnections setting in PostgreSQL enables logging at the end of each session, providing details such as the session's duration. This flag works alongside the log\_connections flag to offer a complete picture of connection activity. Rationale: By default, PostgreSQL does not log details about when sessions end or their duration. Enabling the log\_disconnections flag helps generate logs that can assist in troubleshooting, identifying anomalies, and detecting unusual activity over time. This flag is typically used in conjunction with the log\_connections flag for comprehensive connection logging. Impact: - Enabling session logging increases storage requirements over time. - Improper log management can lead to unnecessary storage costs. - Using the command line to set database flags may reset all omitted flags to their default values, potentially causing configuration issues or triggering instance restarts. It is recommended to apply these changes during off-peak hours. Default Value: By default, the log\_disconnections flag is set to off. Audit Steps: #### Using Google Cloud Console: 1. Navigate to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                ![](https://support.icompaas.com/assets/kb/ca67d85d4e470f7a.png) 2. Select the PostgreSQL instance to open its Instance Overview page.      ![](https://support.icompaas.com/assets/kb/07082f312382dffd.png) 3. Locate the Configuration card.                  ![](https://support.icompaas.com/assets/kb/76fce68db6fed537.png) 4. Verify that the log\_disconnections flag is set to on under the Database Flags section.                ![](https://support.icompaas.com/assets/kb/20fb044edba5e1cd.png) #### Using Google Cloud CLI: Use the following command to verify the log\_disconnections flag for all PostgreSQL instances: gcloud sql instances list --format=json | jq '.\[\].settings.databaseFlags\[\] | select(.name=="log\_disconnections")|.value' 1. The output should display on for the flag. Remediation Steps: #### Using Google Cloud Console: 1. Go to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                     ![](https://support.icompaas.com/assets/kb/9f35bbacfd30dbc2.png) 2. Select the PostgreSQL instance where the flag needs to be updated.         ![](https://support.icompaas.com/assets/kb/392ffdc69f61981f.png) 3. Click Edit.         ![](https://support.icompaas.com/assets/kb/5b004b3a8b08e676.png) 4. Scroll down to the Flags section and click Add a Database Flag.                        ![](https://support.icompaas.com/assets/kb/854a36eff76bbcbb.png) 5. Choose log\_disconnections from the dropdown menu and set its value to on.                 ![](https://support.icompaas.com/assets/kb/50b98fcb5fedb57d.png) 6. Click Save.                         ![](https://support.icompaas.com/assets/kb/cb71849595eae265.png) 7. Verify the changes under the Database Flags section on the Overview page.                       ![](https://support.icompaas.com/assets/kb/a6e2c5155714c723.png) #### Using Google Cloud CLI: Enable the log\_disconnections flag for the PostgreSQL instance using the following command: gcloud sql instances patch \[INSTANCE\_NAME\] --database-flags log\_disconnections=on 1. Note: This command will overwrite all previously configured flags. To retain existing flags, explicitly include them in the command. ## Backout Plan ### Step 1: Revert log\_disconnections Flag to Off If you need to revert the log\_disconnections flag to its default setting, set it to off: gcloud sql instances patch \[INSTANCE\_NAME\] --database-flags log\_disconnections=off ### Step 2: Verify the Reverted Configuration Ensure that the configuration change has been successfully reverted gcloud sql instances describe \[INSTANCE\_NAME\] --format=json | jq '.settings.databaseFlags\[\] | select(.name=="log\_disconnections")|.value' ### Step 3: Notify Stakeholders - Inform the relevant teams (e.g., security and operations) that the logging of disconnections has been disabled. - Discuss any adjustments that may be necessary to maintain proper audit logging for future monitoring. References: 1. [Google Cloud SQL Database Flags Documentation](https://cloud.google.com/sql/docs/postgres/flags) 2. [PostgreSQL Documentation on Runtime Configuration Logging](https://www.postgresql.org/docs/9.6/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHAT) Additional Information: - Configuring the log\_disconnections flag does not require restarting the Cloud SQL instance. - Some database flag settings may affect the stability or availability of the instance and could remove it from the Cloud SQL SLA. Refer to the [Operational Guidelines](https://cloud.google.com/sql/docs/postgres/flags) for more details. - Ensure proper log rotation and retention policies to avoid excessive storage usage. CIS Controls:

Control

Description

IG 1

IG 2

IG 3

8.5 Collect Detailed Audit Logs

Enable audit logging for enterprise assets to capture details such as event sources, timestamps, and user data for forensic investigations.

✅

✅


6.3 Enable Detailed Logging

Configure detailed logging to record essential information, including user actions and system events, for better monitoring and troubleshooting.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.