# 6.2.6 Ensure ‘Log_min_error_statement’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘Error’ or Stricter (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233037-6-2-6-ensure-log-min-error-statement-database-flag-for-cloud-sql-postgresql-instance-is-set-to-err - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: - Level 1 Description: The log\_min\_error\_statement flag defines the minimum severity level of messages that PostgreSQL will treat as error statements. Messages for error statements are logged along with the SQL statement. Valid severity levels (from lowest to highest) include: - DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1 - INFO - NOTICE - WARNING - ERROR - LOG - FATAL - PANIC Each severity level includes messages of higher severity. To ensure proper error classification and auditing, it is recommended to set log\_min\_error\_statement to ERROR or stricter. Rationale: Proper configuration of the log\_min\_error\_statement flag allows accurate identification and logging of error messages and associated SQL statements. This improves troubleshooting and forensic analysis by ensuring critical errors are captured without excessive logging of less relevant information. Setting this flag to ERROR or stricter aligns with best practices for logging and auditing database activity. Impact: - Setting the flag to a less restrictive value (e.g., INFO) may result in excessive logging, increasing storage requirements and making it difficult to identify critical errors. - Setting the flag to a more restrictive value (e.g., FATAL) may exclude essential error messages, hindering effective troubleshooting. - Adjusting custom flags via command-line tools may overwrite existing flags, leading to potential configuration loss or instance restarts. It is recommended to make changes during low-usage periods. Default Value: By default, the log\_min\_error\_statement flag is set to ERROR. Audit Steps: #### Using Google Cloud Console: 1. Go to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.               ![](https://support.icompaas.com/assets/kb/330c2b4530008a25.png) 2. Select the PostgreSQL instance to view its Instance Overview page.      ![](https://support.icompaas.com/assets/kb/91f56a33fd6f0f3b.png) 3. Under the Configuration card, check the value of the log\_min\_error\_statement flag. Ensure it is set to ERROR or stricter.              ![](https://support.icompaas.com/assets/kb/1b1e12c7883a4075.png) #### Using Google Cloud CLI: Verify the log\_min\_error\_statement flag for each PostgreSQL instance:gcloud sql instances describe \[INSTANCE\_NAME\] --format=json | jq '.settings.databaseFlags\[\] | select(.name=="log\_min\_error\_statement")|.value' Remediation Steps: #### Using Google Cloud Console: 1. Navigate to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                       ![](https://support.icompaas.com/assets/kb/8c8a944bc77c9098.png) 2. Select the PostgreSQL instance that requires configuration.                ![](https://support.icompaas.com/assets/kb/ee9bd7b24b45cf35.png) 3. Click Edit.            ![](https://support.icompaas.com/assets/kb/81a95944a9c055dd.png) 4. Scroll to the Flags section.                   ![](https://support.icompaas.com/assets/kb/ab4c42b01f587bb9.png) 5. If the log\_min\_error\_statement flag is not already set, click Add item, choose log\_min\_error\_statement from the dropdown menu, and set it to ERROR or stricter.                       ![](https://support.icompaas.com/assets/kb/11979606f7cf4a49.png) 6. Click Save.                        ![](https://support.icompaas.com/assets/kb/f1bbff3ca11d8f35.png) 7. Verify the changes under the Flags section on the Overview page.             ![](https://support.icompaas.com/assets/kb/fdfc136c2923b47b.png) #### Using Google Cloud CLI: Configure the log\_min\_error\_statement flag for a PostgreSQL instance: gcloud sql instances patch \[INSTANCE\_NAME\] --database-flags log\_min\_error\_statement=ERROR 1. Note: This command overwrites previously set database flags. To retain existing flags, include them in the command along with the new flag. ## Backout Plan: Step 1: Revert log\_min\_error\_statement to a Less Restrictive Value If Needed gcloud sql instances patch --database-flags "log\_min\_error\_statement=WARNING" Step 2: Notify Security and Operations Teams - Inform security and database teams before making further changes. Step 3: Restore from Backup (If Necessary) - If setting log\_min\_error\_statement=ERROR causes operational issues, restore the PostgreSQL instance from a backup. References: 1. [Google Cloud SQL PostgreSQL Flags Documentation](https://cloud.google.com/sql/docs/postgres/flags) 2. [PostgreSQL Runtime Configuration Logging](https://www.postgresql.org/docs/9.6/runtime-config-logging.html#RUNTIMECONFIG-LOGGING-WHEN) Additional Information: - Modifying the log\_min\_error\_statement flag does not require restarting the Cloud SQL instance. - Certain flag configurations may affect instance availability or stability and could void the Cloud SQL SLA. Review the Operational Guidelines before making changes. CIS Controls:

Control

Description

IG 1

IG 2

IG 3

8.5 Collect Detailed Audit Logs

Enable detailed logging to capture sensitive data-related events, including source, timestamp, and user information.

✅

✅


6.3 Enable Detailed Logging

Configure logging to include essential event details such as date, user, and source/destination addresses.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.