PostgreSQL Flexible Server has disconnection logging enabled

Check ID: postgresql_flexible_server_log_disconnections_on
Provider: Azure
Service: postgresql
Severity: MEDIUM
Categories: logging
Resource type: microsoft.dbforpostgresql/flexibleservers

What this check verifies

Azure Database for PostgreSQL Flexible Server uses the log_disconnections setting to record when client sessions end and how long they lasted.

Risk

Without disconnection logs, session timelines and user activity are opaque, weakening auditability and forensics. Abuse such as stolen credentials, short-lived access, or hijacked sessions can go unnoticed, enabling data exfiltration and privilege misuse, impacting confidentiality and integrity.

Recommendation

Enable log_disconnections on all Flexible Servers. Complement with log_connections and appropriate duration/statement logging, centralize and retain logs, and alert on abnormal connect/disconnect patterns. Restrict log access. This enforces accountability, supports defense in depth, and speeds incident response.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az postgres flexible-server parameter set —resource-group <RESOURCE_GROUP> —server-name <SERVER_NAME> —name log_disconnections —value on

# Enable log_disconnections on a PostgreSQL Flexible Server
resource "azurerm_postgresql_flexible_server_configuration" "log_disconnections" {
  server_id = "<example_resource_id>"
  name      = "log_disconnections"
  value     = "on" # Critical: turns log_disconnections ON to pass the check
}

// Enable log_disconnections on an existing PostgreSQL Flexible Server
resource server 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {
  name: '<example_resource_name>'
}

resource logDisconnections 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2022-12-01' = {
  name: 'log_disconnections'
  parent: server
  properties: {
    value: 'on' // Critical: turns log_disconnections ON to pass the check
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = postgresql_flexible_server_log_disconnections_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

PostgreSQL flexible server has log_connections enabled PostgreSQL flexible server retains logs 4 to 7 days

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires