Back to Checks
azure

PostgreSQL Flexible Server has checkpoint logging enabled

postgresql_flexible_server_log_checkpoints_on
Service: postgresqlSeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.dbforpostgresql/flexibleservers

Azure PostgreSQL Flexible Server has checkpoint logging enabled when log_checkpoints=on, recording each checkpoint in the server logs

Prowler logoProwlerprowler-provider-azure

Risk

Without checkpoint logging, visibility into write and recovery activity is reduced, hindering incident investigation and tamper detection. Unseen checkpoint storms or WAL pressure can degrade I/O and recovery, threatening availability and data integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks postgresql_flexible_server_log_checkpoints_on

Recommendation

Enable log_checkpoints=on and send logs to centralized, tamper-resistant storage. Monitor checkpoint frequency and failures with alerts. Apply least privilege to log access and set retention to support forensics as part of a defense-in-depth logging strategy.

Remediation

CLI

az postgres flexible-server parameter set --resource-group <resourceGroupName> --server-name <serverName> --name log_checkpoints --value ON

Terraform

resource "azurerm_postgresql_flexible_server_configuration" "<example_resource_name>" {
  name      = "log_checkpoints"
  server_id = "<example_resource_id>"
  
  value = "ON" # CRITICAL: enables checkpoint logging to pass the check
}

NativeIaC

// Set log_checkpoints to ON on an existing Flexible Server
resource server 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {
  name: '<example_resource_name>'
}

resource cfg 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2022-12-01' = {
  name: 'log_checkpoints'
  parent: server
  properties: {
    value: 'ON' // CRITICAL: enables checkpoint logging to pass the check
  }
}

Other

1In the Azure portal, open your Azure Database for PostgreSQL flexible server
2Go to Settings > Server parameters
3Search for "log_checkpoints"
4Set the value to ON
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.postgresql.postgresql_client import (
    postgresql_client,
)


class postgresql_flexible_server_log_checkpoints_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for (
            subscription,
            flexible_servers,
        ) in postgresql_client.flexible_servers.items():
            subscription_name = postgresql_client.subscriptions.get(
                subscription, subscription
            )
            for server in flexible_servers:
                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has log_checkpoints disabled"
                if server.log_checkpoints == "ON":
                    report.status = "PASS"
                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has log_checkpoints enabled"
                findings.append(report)

        return findings

References