> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-109.md).

# Log levels of the GCP PostgreSQL database are not set to ERROR or lower misconfiguration detected in

## Rule Details

|                        |                               |
| ---------------------- | ----------------------------- |
| Cortex AppSec Rule ID  | APPSEC\_GCP\_109              |
| Category - Subcategory | Logging - Disabled or missing |
| Provider               | GCP                           |
| Severity               | LOW                           |
| Framework              | Terraform, Terraform Plan     |

## Impact

This rule is checking for the log levels of a Google Cloud Platform (GCP) PostgreSQL database. It makes sure that these log levels are set to ERROR or lower.

Why is this important? In short, it's about maintaining the appropriate level of security and managing the efficiency of your log management.

If log levels are set too high, you might capture too much unnecessary information, which can create a lot of noise in your logs, making it harder to identify serious issues. On the other hand, it can also lead to increased costs, as a larger volume of data requires more storage and computational power to analyze.

Setting the log level to ERROR or lower ensures that log captures focus mainly on error events or those of higher significance. This way, troubleshooting becomes more efficient, it's easier to identify and rectify problematic issues, and unnecessary expenditure on data analysis can be reduced. Therefore, not adhering to this policy can lead to inefficient resource management and difficulty in identifying critical database issues.

## How to Fix

*Resource:* google\_sql\_database\_instance

To fix the issue:

You need to set the logging level for your GCP PostgreSQL database to 'ERROR' or lower. This can be done in your Terraform code by setting the `log_min_messages` parameter to ERROR.

## The provided code is secure because it ensures the GCP PostgreSQL database log levels are set to error or lower. This helps in limiting the amount of logged information, thereby keeping the system secure from unnecessary exposure. It allows to log only critical information which is beneficial from a security and resource standpoint. \[source,go]

## resource "google\_sql\_database\_instance" "default" { settings { database\_flags { name = "log\_min\_messages" value = "ERROR" } } }


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-109.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.