| name | cis-azure-database-6.7 |
| description | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL server |
| category | cis-azure-database |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","postgresql","database"] |
| cis_id | 6.7 |
| cis_benchmark | CIS Microsoft Azure Database Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
6.7 Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL server (Automated)
Profile Applicability
Description
Enable log_checkpoints on PostgreSQL flexible servers.
Rationale
Enabling log_checkpoints helps the PostgreSQL Database to log each checkpoint, which in turn generates query and error logs. However, access to transaction logs is not supported. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.
Impact
None documented.
Audit Procedure
Audit from Azure Portal
- Login to Azure Portal using https://portal.azure.com.
- Go to
Azure Database for PostgreSQL servers.
- For each server, under
Settings, click Server parameters.
- In the filter bar, type
log_checkpoints.
- Ensure that
VALUE for log_checkpoints is set to ON.
Audit from Azure CLI
Ensure the below command returns a value of on:
az postgres flexible-server parameter show --resource-group <resourceGroup> --server-name <serverName> --name log_checkpoints
Audit from PowerShell
Ensure the below command returns a Value of on:
Get-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <resourceGroup> -ServerName <serverName> -Name log_checkpoints
Audit from Azure Policy
Policy ID: 70be9e12-c935-49ac-9bd8-fd64b85c1f87
Name: 'Log checkpoints should be enabled for PostgreSQL flexible servers'
Expected Result
The log_checkpoints server parameter should be set to ON.
Remediation
Remediate from Azure Portal
- Login to Azure Portal using https://portal.azure.com.
- Go to
Azure Database for PostgreSQL servers.
- For each server, under
Settings, click Server parameters.