PostgreSQL flexible server has log_connections enabled

​

What this check verifies

Azure Database for PostgreSQL Flexible Server evaluates the log_connections setting that controls logging of client connection attempts and authentication results. The finding indicates whether this parameter is set to ON.

​

Risk

Without connection logging, visibility of access attempts is lost, making brute force and credential stuffing harder to detect. This weakens confidentiality and integrity, hinders incident investigations, and can mask lateral movement or unauthorized data access.

​

Recommendation

Set log_connections to ON and integrate logs with centralized monitoring. Define retention and alerts for abnormal patterns. Combine with least privilege, strong authentication, and network restrictions to deliver defense in depth and prevent unauthorized access.

​

Remediation

Dashboard steps

1. Sign in to the Azure portal
2. Go to: Azure Database for PostgreSQL > Flexible servers > select <example_resource_name>
3. Under Settings, open Server parameters and search for “log_connections”
4. Confirm the parameter shows Value: ON and is Read-only (no change required)

​

References

• https://learn.microsoft.com/en-us/answers/questions/683954/log-connections-cannot-be-set-on-azure-postgresql
• https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/PostgreSQL/log-connections.html
• https://learn.microsoft.com/en-us/azure/postgresql/security/security-audit?tabs=portal

​

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = postgresql_flexible_server_log_connections_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Azure checks