Check ID: postgresql_flexible_server_log_checkpoints_on
Provider: Azure
Service: postgresql
Severity: LOW
Categories: logging
Resource type: microsoft.dbforpostgresql/flexibleservers

What this check verifies

Azure PostgreSQL Flexible Server has checkpoint logging enabled when log_checkpoints=on, recording each checkpoint in the server logs

Risk

Without checkpoint logging, visibility into write and recovery activity is reduced, hindering incident investigation and tamper detection. Unseen checkpoint storms or WAL pressure can degrade I/O and recovery, threatening availability and data integrity.

Recommendation

Enable log_checkpoints=on and send logs to centralized, tamper-resistant storage. Monitor checkpoint frequency and failures with alerts. Apply least privilege to log access and set retention to support forensics as part of a defense-in-depth logging strategy.

Remediation

az postgres flexible-server parameter set —resource-group <resourceGroupName> —server-name <serverName> —name log_checkpoints —value ON

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = postgresql_flexible_server_log_checkpoints_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks