lacework-global-544
4.3.2 Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server (Automated)
Profile Applicability
• Level 1
Description
Enable log_checkpoints
on PostgreSQL Servers
.
Rationale
Enabling log_checkpoints
helps the PostgreSQL Database to Log each checkpoint
in turn generates query and error logs. However, access to transaction logs is not supported. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.
Audit
From Azure Portal
- From Azure Home select the Portal Menu
- Go to
Azure Database
forPostgreSQL
server - For each database, click on
Server parameters
- Search for
log_checkpoints
. - Ensure that value is set to
ON
.
From Azure CLI
Ensure value is set to ON
az postgres server configuration show --resource-group <resourceGroupName> --server-name <serverName> --name log_checkpoints
Remediation
From Azure Portal
- From Azure Home select the Portal Menu
- Go to
Azure Database
forPostgreSQL
server - For each database, click on
Server parameters
- Search for
log_checkpoints
. - Click
ON
and save.
From Azure CLI
Use the below command to update log_checkpoints
configuration.
az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_checkpoints --value on
References
https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server
https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-4-enable-logging-for-azure-resources