# 6.2.7 Ensure the ‘Log_min_duration_statement’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1' (Disabled) (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233038-6-2-7-ensure-the-log-min-duration-statement-database-flag-for-cloud-sql-postgresql-instance-is-set- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: - Level 1 Description: The log\_min\_duration\_statement flag specifies the minimum execution time, in milliseconds, for SQL statements to be logged. A value of -1 disables the logging of SQL statements. It is recommended to set this flag to -1 to prevent SQL statements from being logged. Rationale: Logging SQL statements can expose sensitive information, such as user data or confidential queries, in the logs. To minimize the risk of sensitive information being inadvertently logged, it is advised to disable this flag by setting it to \-1. This ensures no SQL statement durations are logged. Impact: - Disabling log\_min\_duration\_statement prevents the logging of SQL statement execution times. - Enabling this flag may result in sensitive data being logged, posing a security risk. - Modifying this flag via the command line will reset any unspecified flags to their default values, potentially causing configuration issues or requiring instance restarts. Changes should be applied during low-usage periods to avoid disruption. Default Value: The default value for log\_min\_duration\_statement is -1, which disables SQL statement logging. Audit Steps: #### Using Google Cloud Console: 1. Visit the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                           ![](https://support.icompaas.com/assets/kb/d6460129d09b8457.png) 2. Select the desired PostgreSQL instance to open its Instance Overview page.             ![](https://support.icompaas.com/assets/kb/904760bfb38402c2.png) 3. Navigate to the Configuration card.                   ![](https://support.icompaas.com/assets/kb/4052c7c9fee863ec.png) 4. Under Database flags, verify that the log\_min\_duration\_statement flag is set to -1.                   ![](https://support.icompaas.com/assets/kb/eb31118e3413339e.png) #### Using Google Cloud CLI: Execute the following command for each PostgreSQL instance to verify the flag's value: gcloud sql instances describe \[INSTANCE\_NAME\] --format=json | jq '.settings.databaseFlags\[\] | select(.name=="log\_min\_duration\_statement")|.value' Remediation Steps: #### Using Google Cloud Console: 1. Navigate to the [Cloud SQL Instances](https://console.cloud.google.com/sql/instances) page.                     ![](https://support.icompaas.com/assets/kb/18822fe4b0a00920.png) 2. Select the PostgreSQL instance requiring configuration.                  ![](https://support.icompaas.com/assets/kb/c67cc6614d11baeb.png) 3. Click Edit        ![](https://support.icompaas.com/assets/kb/16909f01b26f48ff.png) 4. Scroll to the Flags section.                  ![](https://support.icompaas.com/assets/kb/0ad2a0f5ececc38d.png) 5. If the log\_min\_duration\_statement flag is not already set, click Add item, select the flag from the dropdown menu, and set its value to -1.           ![](https://support.icompaas.com/assets/kb/4a695b08e9890d45.png) 6. Click Save.                      ![](https://support.icompaas.com/assets/kb/ebdbe1e4230a4c9f.png) 7. Verify the changes under the Flags section on the Overview page.           ![](https://support.icompaas.com/assets/kb/69e0d6e99a67fd14.png) #### Using Google Cloud CLI: List all Cloud SQL database instances: gcloud sql instances list Configure the log\_min\_duration\_statement flag for the required PostgreSQL instances: gcloud sql instances patch \[INSTANCE\_NAME\] --database-flags log\_min\_duration\_statement=-1 1. Note: This command overwrites all previously set flags. Include all required flags in the command to preserve them. Backout Plan: Step 1: Re-enable Query Logging If Needed gcloud sql instances patch --database-flags "log\_min\_duration\_statement=1000" Step 2: Notify Security Teams - Inform security and database teams before re-enabling SQL logging. Step 3: Restore from Backup (If Necessary) - If disabling SQL statement logging causes application failures, restore the PostgreSQL instance from a backup. Step 4: Validate Rollback Success - Run the audit steps again to confirm that the intended log\_min\_duration\_statement setting is applied. References: 1. [Google Cloud SQL PostgreSQL Flags Documentation](https://cloud.google.com/sql/docs/postgres/flags) 2. [PostgreSQL Runtime Configuration Logging Documentation](https://www.postgresql.org/docs/current/runtime-config-logging.html#RUNTIMECONFIG-LOGGING-WHAT) Additional Information: - Modifying the log\_min\_duration\_statement flag does not require restarting the Cloud SQL instance. - Certain database flag settings may impact instance stability and availability, potentially affecting the Cloud SQL SLA. Review Operational Guidelines before making changes. CIS Controls:

Control

Description

IG 1

IG 2

IG 3

8.5 Collect Detailed Audit Logs

Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, timestamp, and user information.

✅

✅


6.3 Enable Detailed Logging

Enable system logging to capture detailed event information, including user, timestamp, and source/destination addresses.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.