---
title: "NET-DB-021 PostgreSQL Connection Logging Off"
canonical: https://openvapt.com/checks/NET-DB-021.html
html: https://openvapt.com/checks/NET-DB-021.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# NET-DB-021 PostgreSQL Connection Logging Off

log_connections and log_disconnections are off, so successful logins leave no record.

- Domain: Network
- Severity: Low
- Control category: Logging and Monitoring
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`
- CIS Controls v8: 8.2
- NIST CSF 2.0: PR.PS-04
- CWE: CWE-778
- OWASP Top 10 2021: A09:2021
- OWASP ASVS 4.0.3: 7.1.3
- NIST SP 800-53 Rev. 5: AU-2, AU-12, AC-2(4)
- Benchmark topic: Database connection logging (topic only, no benchmark text)

## Why It Matters

Failed logins are logged by default, but successful ones are not. Knowing which role connected from where and for how long is the base evidence for spotting credential misuse and for any later investigation.

## How It Detects

Reads postgresql.conf and flags log_connections not on. log_disconnections is reported as evidence.

## How to Fix

Set  log_connections = on  and  log_disconnections = on  in postgresql.conf and reload. On PostgreSQL 18 and newer, log_connections accepts a list such as  receipt,authentication,authorization .

## How to Verify

```
SHOW log_connections;  should print on (or a non-empty list).
```

## Learn the Theory

- [P3 Network Exposure and Firewalls](https://openvapt.com/academy/p3.md)
- [P8 Data Services: Databases, File Shares, DNS and Mail](https://openvapt.com/academy/p8.md)
- [P19 Database, Mail and DNS Hardening](https://openvapt.com/academy/p19.md)

## References

- [PostgreSQL, Error Reporting and Logging](https://www.postgresql.org/docs/current/runtime-config-logging.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go

Run it: `openvapt scan --only NET-DB-021`. Read it offline: `openvapt explain NET-DB-021`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/NET-DB-021.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.