Parameter · Reporting and Logging / Where to Log
log_file_mode
Sets the file permissions for log files. The parameter value is expected to be a numeric mode specification in the form accepted by the chmod and umask system calls. (To use the customary octal format the number must start with a 0 (zero).)
- Default:
384 - Type: integer
- Range: 0 … 511
- Applies: Reload
In plain words
Sets who may read the log files the collector creates. The default 0600 lets only the operating-system user that runs PostgreSQL read and write them. 0640 also lets members of its group read them, handy for monitoring agents.
For DBAs and operators
A numeric mode as for chmod; write it with a leading zero to mean octal. SHOW and pg_settings.setting print it in octal, while boot_val/reset_val in pg_settings hold the decimal value (384 = 0600, 416 = 0640). In SQL, quote it: ALTER SYSTEM SET log_file_mode = '0640'. An unquoted 0640 is read as the number 640 and rejected:
Applies only to files the logging collector creates (not to an existing file, nor to a pg_ctl -l file), and is ignored on Windows. The logger sets the umask itself while creating the file, so the server's umask does not reduce these bits (verified: a server started with umask 077 created 0640 files). The group can only reach the files if it can enter the directories: either the data directory was initialised with group access (initdb -g), or, as the documentation suggests, log_directory points outside the data directory.
Logs can contain SQL text with literal values and bind parameters (passwords in ALTER ROLE … PASSWORD statements, personal data). Think twice before making them world-readable (0644).
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().