Check Details

• Resource: Azure Database for PostgreSQL – Flexible Server
• Check: Ensure log_checkpoints Parameter Is Enabled
• Risk: If checkpoint logging is disabled, database administrators may lack visibility into checkpoint operations, making it difficult to diagnose performance issues, detect abnormal behavior, or conduct forensic investigations when required.

Remediation via Azure Portal

1. Log in to the Azure Portal.
2. Navigate to Azure Database for PostgreSQL Flexible Servers and select the affected server.
3. Under Settings, select Server parameters.
4. In the search bar, type log_checkpoints.
5. Ensure the parameter log_checkpoints is set to ON.
6. Click Save to apply the configuration changes.

Remediation via Azure CLI

1. Open Azure Cloud Shell or a local terminal with Azure CLI installed.

2. Check the current value of the log_checkpoints parameter:

   

   az postgres flexible-server parameter show \
    --resource-group <resource-group> \
    --server-name <server-name> \
    --name log_checkpoints \
    --query value
   

3. Enable checkpoint logging if it is disabled:

   

   az postgres flexible-server parameter set \
    --resource-group <resource-group> \
    --server-name <server-name> \
    --name log_checkpoints \
    --value on
   

4. Verify the parameter has been updated:

   

   az postgres flexible-server parameter show \
    --resource-group <resource-group> \
    --server-name <server-name> \
    --name log_checkpoints \
    --query value
   

Replace <resource-group> and <server-name> with your actual values. The output should return "on" to confirm compliance.