Setting Up Database Monitoring for Amazon RDS managed Postgres

Database Monitoring provides deep visibility into your Postgres databases by exposing query metrics, query samples, explain plans, database states, failovers, and events.

The Agent collects telemetry directly from the database by logging in as a read-only user. Do the following setup to enable Database Monitoring with your Postgres database:

1. Configure the AWS integration
2. Configure database parameters
3. Grant the Agent access to the database
4. Install and configure the Agent
5. Install the RDS integration

Before you begin

Supported PostgreSQL versions

9.6, 10, 11, 12, 13, 14, 15, 16, 17, 18

Supported Agent versions

7.36.1+

Performance impact

The default Agent configuration for Database Monitoring is conservative, but you can adjust settings such as the collection interval and query sampling rate to better suit your needs. For most workloads, the Agent represents less than one percent of query execution time on the database and less than one percent of CPU.

Database Monitoring runs as an integration on top of the base Agent (see benchmarks).

Proxies, load balancers, and connection poolers

The Datadog Agent must connect directly to the host being monitored. For self-hosted databases, use 127.0.0.1 or the socket. The Agent should not connect to the database through a proxy, load balancer, or connection pooler such as pgbouncer. If the Agent connects to different hosts while it is running (as in the case of failover, load balancing, and so on), the Agent calculates the difference in statistics between two hosts, producing inaccurate metrics.

Data security considerations

See Sensitive information for information about what data the Agent collects from your databases and how to ensure it is secure.

Configure the AWS integration

Enable Resource Collection in the Resource Collection section of your Amazon Web Services integration tile.

Configure Postgres settings

Configure the following parameters in the DB parameter group and then restart the server for the settings to take effect. For more information about these parameters, see the Postgres documentation.

Required parameters

Optional parameters

Enable auto_explain (optional)

By default, the agent only gathers EXPLAIN plans for a sampling of in-flight queries. These plans are of a more general nature, especially when application code uses prepared statements.

To collect full EXPLAIN ANALYZE plans taken from all queries, you need to use auto_explain, a first-party extension bundled with PostgreSQL available in all major providers. Logging collection is a prerequisite to auto_explain collection, so enable it before continuing.

1. Configure auto_explain settings. The log format must be json, but other settings can vary depending on your application. This example logs an EXPLAIN ANALYZE plan for all queries over one second, including buffer information but omitting timing (which can have overhead).

2. Change the log_line_prefix to enable richer event correlation. For more information, see the RDS DB parameter groups documentation. auto_explain ingestion requires this be set to %m:%r:%u@%d:[%p]:%l:%e:%s:%v:%x:%c:%q%a.

3. To ensure your RDS instances are forwarding logs to CloudWatch and Datadog, follow the instructions for Amazon RDS Log Collection.

Grant the Agent access

The Datadog Agent requires read-only access to the database server to collect statistics and queries.

Run the following SQL commands on the primary database server (the writer) in the cluster if Postgres is replicated. The Agent can collect telemetry from all databases on the server regardless of which database it connects to. Use the default postgres database unless you need the Agent to run custom queries against data unique to a different database.

Connect to your chosen database as a superuser (or another user with sufficient permissions). For example, to connect to the postgres database using psql:

psql -h mydb.example.com -d postgres -U postgres

Create the datadog user:

CREATEUSERdatadogWITHpassword'<PASSWORD>';

Note: IAM authentication is also supported. See the guide on how to configure this for your RDS instance.

ALTERROLEdatadogINHERIT;

CREATESCHEMAdatadog;GRANTUSAGEONSCHEMAdatadogTOdatadog;GRANTUSAGEONSCHEMApublicTOdatadog;GRANTpg_monitorTOdatadog;CREATEEXTENSIONIFNOTEXISTSpg_stat_statementsschemapublic;

CREATESCHEMAdatadog;GRANTUSAGEONSCHEMAdatadogTOdatadog;GRANTUSAGEONSCHEMApublicTOdatadog;GRANTpg_monitorTOdatadog;CREATEEXTENSIONIFNOTEXISTSpg_stat_statementsschemapublic;

CREATESCHEMAdatadog;GRANTUSAGEONSCHEMAdatadogTOdatadog;GRANTUSAGEONSCHEMApublicTOdatadog;GRANTSELECTONpg_stat_databaseTOdatadog;CREATEEXTENSIONIFNOTEXISTSpg_stat_statements;

CREATEORREPLACEFUNCTIONdatadog.pg_stat_activity()RETURNSSETOFpg_stat_activityAS$$SELECT*FROMpg_catalog.pg_stat_activity;$$LANGUAGEsqlSECURITYDEFINER;CREATEORREPLACEFUNCTIONdatadog.pg_stat_statements()RETURNSSETOFpg_stat_statementsAS$$SELECT*FROMpg_stat_statements;$$LANGUAGEsqlSECURITYDEFINER;

Create the explain plan function

Create the following function in every database to enable the Agent to collect explain plans:

CREATEORREPLACEFUNCTIONdatadog.explain_statement(l_queryTEXT,OUTexplainJSON)RETURNSSETOFJSONAS$$DECLAREcursREFCURSOR;planJSON;BEGINSETTRANSACTIONREADONLY;OPENcursFOREXECUTEpg_catalog.concat('EXPLAIN (FORMAT JSON) ',l_query);FETCHcursINTOplan;CLOSEcurs;RETURNQUERYSELECTplan;END;$$LANGUAGE'plpgsql'RETURNSNULLONNULLINPUTSECURITYDEFINER;

Create the column statistics function

Create the following function in every database to enable the Agent to collect column-level table statistics from pg_stats:

CREATEORREPLACEFUNCTIONdatadog.column_statistics()RETURNSTABLE(schemanamename,tablenamename,attnamename,n_distinctreal,avg_widthinteger,null_fracreal,inheritedboolean,correlationreal,most_common_freqsreal[])AS$$SELECTschemaname,tablename,attname,n_distinct,avg_width,null_frac,inherited,correlation,most_common_freqsFROMpg_catalog.pg_statsWHEREschemanameNOTIN('pg_catalog','information_schema');$$LANGUAGEsqlSECURITYDEFINERSETsearch_path=pg_catalog,pg_temp;

After the function exists, enable collection in your Postgres instance config:

instances:- dbm:true...collect_column_statistics:enabled:true

For tuning options, see Advanced Configuration.

Securely store your password

Store your password using secret management software such as Vault. You can then reference this password as ENC[<SECRET_NAME>] in your Agent configuration files: for example, ENC[datadog_user_database_password]. See Secrets Management for more information.

The examples on this page use datadog_user_database_password to refer to the name of the secret where your password is stored. It is possible to reference your password in plain text, but this is not recommended.

Verify database permissions

To verify the permissions are correct, run the following commands to confirm the Agent user is able to connect to the database and read the core tables:

psql -h localhost -U datadog postgres -A \
 -c "select * from pg_stat_database limit 1;" \
 && echo -e "\e[0;32mPostgres connection - OK\e[0m" \
 || echo -e "\e[0;31mCannot connect to Postgres\e[0m"
psql -h localhost -U datadog postgres -A \
 -c "select * from pg_stat_activity limit 1;" \
 && echo -e "\e[0;32mPostgres pg_stat_activity read OK\e[0m" \
 || echo -e "\e[0;31mCannot read from pg_stat_activity\e[0m"
psql -h localhost -U datadog postgres -A \
 -c "select * from pg_stat_statements limit 1;" \
 && echo -e "\e[0;32mPostgres pg_stat_statements read OK\e[0m" \
 || echo -e "\e[0;31mCannot read from pg_stat_statements\e[0m"

psql -h localhost -U datadog postgres -A \
 -c "select * from pg_stat_database limit 1;" \
 && echo -e "\e[0;32mPostgres connection - OK\e[0m" \
 || echo -e "\e[0;31mCannot connect to Postgres\e[0m"
psql -h localhost -U datadog postgres -A \
 -c "select * from datadog.pg_stat_activity() limit 1;" \
 && echo -e "\e[0;32mPostgres pg_stat_activity read OK\e[0m" \
 || echo -e "\e[0;31mCannot read from pg_stat_activity\e[0m"
psql -h localhost -U datadog postgres -A \
 -c "select * from datadog.pg_stat_statements() limit 1;" \
 && echo -e "\e[0;32mPostgres pg_stat_statements read OK\e[0m" \
 || echo -e "\e[0;31mCannot read from pg_stat_statements\e[0m"

When it prompts for a password, use the password you entered when you created the datadog user.

Install and configure the Agent

To monitor RDS hosts, install the Datadog Agent in your infrastructure and configure it to connect to each instance endpoint remotely. The Agent does not need to run on the database, it only needs to connect to it. For additional Agent installation methods not mentioned here, see the Agent installation instructions.

export DD_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
export DD_AGENT_VERSION=<AGENT_VERSION>
docker run -e "DD_API_KEY=${DD_API_KEY}" \
 -v /var/run/docker.sock:/var/run/docker.sock:ro \
 -l com.datadoghq.ad.checks='{"postgres": {
 "init_config": {},
 "instances": [{
 "dbm": true,
 "host": "<AWS_INSTANCE_ENDPOINT>",
 "port": 5432,
 "username": "datadog",
 "password": "<UNIQUEPASSWORD>",
 "aws": {
 "instance_endpoint": "<AWS_INSTANCE_ENDPOINT>",
 "region": "<REGION>"
 },
 "tags": ["dbinstanceidentifier:<DB_INSTANCE_NAME>"]
 }]
 }}' \
 registry.datadoghq.com/agent:${DD_AGENT_VERSION}

"pg_stat_statements_view": "datadog.pg_stat_statements()","pg_stat_activity_view": "datadog.pg_stat_activity()"

FROMregistry.datadoghq.com/agent:<AGENT_VERSION>LABEL "com.datadoghq.ad.check_names"='["postgres"]'LABEL "com.datadoghq.ad.init_configs"='[{}]'LABEL "com.datadoghq.ad.instances"='[{"dbm": true, "host": "<AWS_INSTANCE_ENDPOINT>", "port": 5432,"username": "datadog","password": "ENC[datadog_user_database_password]","aws": {"instance_endpoint": "<AWS_INSTANCE_ENDPOINT>", "region": "<REGION>"}, "tags": ["dbinstanceidentifier:<DB_INSTANCE_NAME>"]}]'

"pg_stat_statements_view": "datadog.pg_stat_statements()","pg_stat_activity_view": "datadog.pg_stat_activity()"

cluster_check:true# Make sure to include this flaginit_config:instances:- dbm:truehost:'<AWS_INSTANCE_ENDPOINT>'port:5432username:datadogpassword:'ENC[datadog_user_database_password]'aws:instance_endpoint:<AWS_INSTANCE_ENDPOINT>region:<REGION>tags:- "dbinstanceidentifier:<DB_INSTANCE_NAME>"## Required: For Postgres 9.6, uncomment these lines to use the functions created in the setup# pg_stat_statements_view: datadog.pg_stat_statements()# pg_stat_activity_view: datadog.pg_stat_activity()

apiVersion:v1kind:Servicemetadata:name:postgreslabels:tags.datadoghq.com/env:'<ENV>'tags.datadoghq.com/service:'<SERVICE>'annotations:ad.datadoghq.com/service.checks:| {
 "postgres": {
 "init_config": <INIT_CONFIG>,
 "instances": [
 {
 "dbm": true,
 "host": "<AWS_INSTANCE_ENDPOINT>",
 "port": 5432,
 "username": "datadog",
 "password": "ENC[datadog_user_database_password]",
 "aws": {
 "instance_endpoint": "<AWS_INSTANCE_ENDPOINT>",
 "region": "<REGION>"
 },
 "tags": [
 "dbinstanceidentifier:<DB_INSTANCE_NAME>"
 ]
 }
 ]
 }
 }spec:ports:- port:5432protocol:TCPtargetPort:5432name:postgres

"pg_stat_statements_view": "datadog.pg_stat_statements()",
"pg_stat_activity_view": "datadog.pg_stat_activity()"

Verify Agent setup

Run the Agent’s status subcommand and look for postgres under the Checks section. Or visit the Databases page to get started!

Example Agent Configurations

One agent connecting to multiple hosts

It is common to configure a single Agent host to connect to multiple remote database instances (see Agent installation architectures for DBM). To connect to multiple hosts, create an entry for each host in the Postgres integration config.

init_config:instances:- dbm:truehost:example-service-primary.example-host.comport:5432username:datadogpassword:'ENC[datadog_user_database_password]'tags:- 'env:prod'- 'team:team-discovery'- 'service:example-service'- dbm:truehost:example-service–replica-1.example-host.comport:5432username:datadogpassword:'ENC[datadog_user_database_password]'tags:- 'env:prod'- 'team:team-discovery'- 'service:example-service'- dbm:truehost:example-service–replica-2.example-host.comport:5432username:datadogpassword:'ENC[datadog_user_database_password]'tags:- 'env:prod'- 'team:team-discovery'- 'service:example-service'[...]

Monitoring multiple databases on a database host

Use the database_autodiscovery option to permit the Agent to discover all databases on your host to monitor. You can specify include or exclude fields to narrow the scope of databases discovered. See the sample postgres.d/conf.yaml for more details.

init_config:instances:- dbm:truehost:example-service-primary.example-host.comport:5432username:datadogpassword:'ENC[datadog_user_database_password]'database_autodiscovery:enabled:true# Optionally, set the include field to specify# a set of databases you are interested in discoveringinclude:- mydb.*- example.*tags:- 'env:prod'- 'team:team-discovery'- 'service:example-service'

Running custom queries

To collect custom metrics, use the custom_queries option. See the sample postgres.d/conf.yaml for more details.

init_config:instances:- dbm:truehost:localhostport:5432username:datadogpassword:'ENC[datadog_user_database_password]'custom_queries:- metric_prefix:employeequery:SELECT age, salary, hours_worked, name FROM hr.employees;columns:- name:custom.employee_agetype:gauge- name:custom.employee_salarytype:gauge- name:custom.employee_hourstype:count- name:nametype:tagtags:- 'table:employees'

Monitoring relation metrics for multiple databases

In order to collect relation metrics (such as postgresql.seq_scans, postgresql.dead_rows, postgresql.index_rows_read, and postgresql.table_size), the Agent must be configured to connect to each database (by default, the Agent only connects to the postgres database).

Specify a single “DBM” instance to collect DBM telemetry from all databases. Use the database_autodiscovery option to avoid specifying each database name.

init_config:instances:# This instance is the "DBM" instance. It will connect to the# all logical databases, and send DBM telemetry from all databases- dbm:truehost:example-service-primary.example-host.comport:5432username:datadogpassword:'ENC[datadog_user_database_password]'database_autodiscovery:enabled:trueexclude:- ^users$- ^inventory$relations:- relation_regex:.*# This instance only collects data from the `users` database# and collects relation metrics from tables prefixed by "2022_"- host:example-service-primary.example-host.comport:5432username:datadogpassword:'ENC[datadog_user_database_password]'dbname:usersdbstrict:truerelations:- relation_regex:2022_.*relkind:- r- i# This instance only collects data from the `inventory` database# and collects relation metrics only from the specified tables- host:example-service-primary.example-host.comport:5432username:datadogpassword:'ENC[datadog_user_database_password]'dbname:inventorydbstrict:truerelations:- relation_name:products- relation_name:external_seller_products

Collecting schemas

To enable this feature, use the collect_schemas option. You must also configure the Agent to connect to each logical database.

Use the database_autodiscovery option to avoid specifying each logical database. See the sample postgres.d/conf.yaml for more details.

init_config:# This instance only collects data from the `users` database# and collects relation metrics only from the specified tablesinstances:- dbm:truehost:example-service-primary.example-host.comport:5432username:datadogpassword:'ENC[datadog_user_database_password]'dbname:usersdbstrict:truecollect_schemas:enabled:truerelations:- products- external_seller_products# This instance detects every logical database automatically# and collects relation metrics from every table- dbm:truehost:example-service–replica-1.example-host.comport:5432username:datadogpassword:'ENC[datadog_user_database_password]'database_autodiscovery:enabled:truecollect_schemas:enabled:truerelations:- relation_regex:.*

Working with hosts through a proxy

If the Agent must connect through a proxy such as the Cloud SQL Auth proxy, all telemetry is tagged with the hostname of the proxy rather than the database instance. Use the reported_hostname option to set a custom override of the hostname detected by the Agent.

init_config:instances:- dbm:truehost:localhostport:5000username:datadogpassword:'ENC[datadog_user_database_password]'reported_hostname:example-service-primary- dbm:truehost:localhostport:5001username:datadogpassword:'ENC[datadog_user_database_password]'reported_hostname:example-service-replica-1

Install the RDS Integration

To see infrastructure metrics from AWS, such as CPU, alongside the database telemetry in DBM, install the RDS integration (optional).

Troubleshooting

If you have installed and configured the integrations and Agent as described and it is not working as expected, see Troubleshooting.

Further reading

Request a personalized demo