> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-109.md).

# Log levels of the GCP PostgreSQL database are not set to ERROR or lower misconfiguration detected in

## Rule Details

|                        |                               |
| ---------------------- | ----------------------------- |
| Cortex AppSec Rule ID  | APPSEC\_GCP\_109              |
| Category - Subcategory | Logging - Disabled or missing |
| Provider               | GCP                           |
| Severity               | LOW                           |
| Framework              | Terraform, Terraform Plan     |

## Impact

This rule is checking for the log levels of a Google Cloud Platform (GCP) PostgreSQL database. It makes sure that these log levels are set to ERROR or lower.

Why is this important? In short, it's about maintaining the appropriate level of security and managing the efficiency of your log management.

If log levels are set too high, you might capture too much unnecessary information, which can create a lot of noise in your logs, making it harder to identify serious issues. On the other hand, it can also lead to increased costs, as a larger volume of data requires more storage and computational power to analyze.

Setting the log level to ERROR or lower ensures that log captures focus mainly on error events or those of higher significance. This way, troubleshooting becomes more efficient, it's easier to identify and rectify problematic issues, and unnecessary expenditure on data analysis can be reduced. Therefore, not adhering to this policy can lead to inefficient resource management and difficulty in identifying critical database issues.

## How to Fix

*Resource:* google\_sql\_database\_instance

To fix the issue:

You need to set the logging level for your GCP PostgreSQL database to 'ERROR' or lower. This can be done in your Terraform code by setting the `log_min_messages` parameter to ERROR.

## The provided code is secure because it ensures the GCP PostgreSQL database log levels are set to error or lower. This helps in limiting the amount of logged information, thereby keeping the system secure from unnecessary exposure. It allows to log only critical information which is beneficial from a security and resource standpoint. \[source,go]

## resource "google\_sql\_database\_instance" "default" { settings { database\_flags { name = "log\_min\_messages" value = "ERROR" } } }


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-109.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.