Check ID:
Provider: Azure
Service:
Severity: LOW
Categories:
Resource type:
postgresql_flexible_server_log_checkpoints_onProvider: Azure
Service:
postgresqlSeverity: LOW
Categories:
loggingResource type:
microsoft.dbforpostgresql/flexibleserversWhat this check verifies
Azure PostgreSQL Flexible Server has checkpoint logging enabled whenlog_checkpoints=on, recording each checkpoint in the server logs
Risk
Without checkpoint logging, visibility into write and recovery activity is reduced, hindering incident investigation and tamper detection. Unseen checkpoint storms or WAL pressure can degrade I/O and recovery, threatening availability and data integrity.Recommendation
Enablelog_checkpoints=on and send logs to centralized, tamper-resistant storage. Monitor checkpoint frequency and failures with alerts. Apply least privilege to log access and set retention to support forensics as part of a defense-in-depth logging strategy.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az postgres flexible-server parameter set —resource-group <resourceGroupName> —server-name <serverName> —name log_checkpoints —value ON
References
- https://support.icompaas.com/support/solutions/articles/62000234792-enable-log-checkpoints-parameter-on-azure-postgresql-servers-for-improved-monitoring-and-troubleshoot
- https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/PostgreSQL/log-checkpoints.html#
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = postgresql_flexible_server_log_checkpoints_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks