Other Articles

PostgreSQL Flexible Server – Enable Connection Logging

This check ensures that connection logging is enabled for Azure PostgreSQL Flexible Servers by setting the server parameter log_connections to ON. Enabling connection logging helps monitor client access attempts and supports security monitoring and auditing.

Check Details

  • Resource: Azure PostgreSQL Flexible Server
  • Check: Ensure log_connections Parameter Is Enabled
  • Risk: If connection logging is disabled, client connection attempts may not be recorded, reducing visibility into authentication events and potentially hindering investigation of unauthorized access or suspicious activity.

Remediation via Azure Portal

  1. Log in to the Azure Portal. Azure Portal dashboard
  2. Navigate to Azure Database for PostgreSQL Flexible Servers and select the affected server. PostgreSQL Flexible Servers list
  3. In the left-hand menu, select Server parameters under Settings. PostgreSQL server parameters
  4. Search for the parameter log_connections.
  5. Ensure the value of log_connections is set to ON. PostgreSQL server log connections
  6. Click Save to apply the changes.

Remediation via Azure CLI

  1. Open Azure Cloud Shell or a local terminal with Azure CLI installed. Azure Cloud Shell
  2. Check the current value of the log_connections parameter:

    az postgres flexible-server parameter show \
     --resource-group <resource-group> \
     --server-name <postgres-server-name> \
     --name log_connections
    
  3. Enable connection logging by setting log_connections to ON:

    az postgres flexible-server parameter set \
     --resource-group <resource-group> \
     --server-name <postgres-server-name> \
     --name log_connections \
     --value on
    
  4. Verify that the parameter is enabled:

    az postgres flexible-server parameter show \
     --resource-group <resource-group> \
     --server-name <postgres-server-name> \
     --name log_connections \
     --query value
    

Replace <resource-group> and <postgres-server-name> with your actual values. The output should confirm that the parameter value is set to on.