Overview

---

What You'll Learn

Prerequisites

1. Enable Postgres Logging

A Quick Primer on Postgres Logging

Production vs. development trade-off: log_statement=all generates a lot of log data and is generally not recommended for production workloads. For production, ddl combined with log_min_duration_statement for slow queries gives you the important details without the volume. For this guide, we use all so every test query is visible in Grafana.

Snowflake Postgres log line prefix

[%p][%b][%v][%x] %q[user=%u,db=%d,app=%a] [%h]

Configure Logging on Your Snowflake Postgres Instance

ALTER SYSTEM SET log_statement = 'all';

2. Confirm Logs in the Snowflake Event Table

CREATE TABLE cookie_monster (
    id SERIAL PRIMARY KEY,
    cookie_type VARCHAR(100),
    flavor VARCHAR(50),
    crunchiness INT CHECK (crunchiness BETWEEN 1 AND 10),
    nom_rating DECIMAL(3,1),
    eaten_at TIMESTAMP DEFAULT NOW()
);

INSERT INTO cookie_monster (cookie_type, flavor, crunchiness, nom_rating)
VALUES
    ('Chocolate Chip', 'chocolate', 8, 9.5),
    ('Snickerdoodle', 'cinnamon', 6, 8.7),
    ('Oatmeal Raisin', 'oat', 7, 7.2),
    ('Double Chocolate', 'dark chocolate', 9, 9.8),
    ('Peanut Butter', 'peanut', 5, 8.1);

SELECT * FROM cookie_monster WHERE crunchiness > 7;
SELECT cookie_type, nom_rating FROM cookie_monster ORDER BY nom_rating DESC;
SELECT AVG(crunchiness) AS avg_crunch, MAX(nom_rating) AS best_nom FROM cookie_monster;

-- Replace the instance ID with your Postgres instance's ID
-- Find it with: SHOW POSTGRES INSTANCES;  (look at the "id" column)
SELECT
    TIMESTAMP,
    RESOURCE_ATTRIBUTES['instance.id']::STRING AS instance_id,
    VALUE['MESSAGE']::STRING AS message
FROM SNOWFLAKE.TELEMETRY.EVENTS
WHERE TIMESTAMP > DATEADD('hour', -1, CURRENT_TIMESTAMP())
  AND RECORD_TYPE = 'LOG'
  AND RESOURCE_ATTRIBUTES['instance.id']::STRING = '<YOUR_INSTANCE_ID>'
ORDER BY TIMESTAMP DESC
LIMIT 20;

Tip: To find your Postgres instance ID, run SHOW POSTGRES INSTANCES; and look at the id column. It's a string like 4jypgsndvzd5ta6ufaryx6owja.

3. Create the Snowflake Role and Grants

USE ROLE ACCOUNTADMIN;

-- Create the Grafana role
CREATE ROLE IF NOT EXISTS GRAFANA;
GRANT ROLE GRAFANA TO ROLE ACCOUNTADMIN;

-- Grant IMPORTED PRIVILEGES on the SNOWFLAKE database
-- Required for Grafana to read the event table.
-- USAGE alone is NOT sufficient — you must use IMPORTED PRIVILEGES.
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE GRAFANA;

-- Grant warehouse usage (replace with your warehouse name)
GRANT USAGE ON WAREHOUSE MY_WAREHOUSE TO ROLE GRAFANA;

Create a Proxy View for Grafana

-- Create a database and schema for Grafana
CREATE DATABASE IF NOT EXISTS GRAFANA_DB;
CREATE SCHEMA IF NOT EXISTS GRAFANA_DB.MONITORING;

-- Create a view that filters to Postgres syslog events
CREATE OR REPLACE VIEW GRAFANA_DB.MONITORING.POSTGRES_LOGS AS
SELECT *
FROM SNOWFLAKE.TELEMETRY.EVENTS
WHERE RECORD_TYPE = 'LOG'
  AND RESOURCE_ATTRIBUTES['service.name']::STRING = 'postgres_syslog';

-- Grant access to the Grafana role
GRANT USAGE ON DATABASE GRAFANA_DB TO ROLE GRAFANA;
GRANT USAGE ON SCHEMA GRAFANA_DB.MONITORING TO ROLE GRAFANA;
GRANT SELECT ON VIEW GRAFANA_DB.MONITORING.POSTGRES_LOGS TO ROLE GRAFANA;

SHOW GRANTS TO ROLE GRAFANA;

4. Generate RSA Key Pair

Generate the Keys

mkdir -p ~/.snowflake/grafana_keys

# Generate an unencrypted RSA private key (PKCS#8 format)
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out ~/.snowflake/grafana_keys/grafana_rsa_key.p8 -nocrypt

# Extract the public key
openssl rsa -in ~/.snowflake/grafana_keys/grafana_rsa_key.p8 -pubout -out ~/.snowflake/grafana_keys/grafana_rsa_key.pub

Get the Public Key Value (for Snowflake)

# Print the public key without the header/footer lines (this is what Snowflake expects)
grep -v "BEGIN\|END" ~/.snowflake/grafana_keys/grafana_rsa_key.pub | tr -d '\n'

Get the Private Key (for Grafana)

# Print the full private key including headers (Grafana needs the complete PEM block)
cat ~/.snowflake/grafana_keys/grafana_rsa_key.p8

5. Create the Snowflake Service User

Key distinction: GRAFANA is the role. GRAFANA_USER is the user. When configuring the Grafana data source, you'll enter GRAFANA_USER as the username and GRAFANA as the role.

USE ROLE ACCOUNTADMIN;

CREATE USER IF NOT EXISTS GRAFANA_USER
  TYPE = SERVICE
  DEFAULT_ROLE = GRAFANA
  DEFAULT_WAREHOUSE = MY_WAREHOUSE
  DEFAULT_NAMESPACE = GRAFANA_DB.MONITORING;

-- Assign the RSA public key (paste the key value from Step 4)
ALTER USER GRAFANA_USER SET RSA_PUBLIC_KEY = '<paste_public_key_here>';

-- Grant the GRAFANA role to the user
GRANT ROLE GRAFANA TO USER GRAFANA_USER;

6. Install and Configure the Grafana Snowflake Data Source

Install the Plugin

grafana-cli plugins install grafana-snowflake-datasource

Configure the Data Source

Important: Use the GRAFANA_DB database and MONITORING schema (the proxy view from Step 3) — not SNOWFLAKE / TELEMETRY. The Grafana plugin's connection test runs USE SCHEMA, which fails against schemas accessed via IMPORTED PRIVILEGES. The proxy view avoids this issue entirely.

7. Explore Postgres Logs in Grafana

Basic Log Exploration

SELECT
    TIMESTAMP AS time,
    VALUE['SEVERITY_TEXT']::STRING AS level,
    VALUE['MESSAGE']::STRING AS message,
    RESOURCE_ATTRIBUTES['instance.id']::STRING AS instance_id
FROM POSTGRES_LOGS
WHERE $__timeFilter(TIMESTAMP)
ORDER BY TIMESTAMP DESC

Grafana macros: $__timeFilter(TIMESTAMP) is a Grafana macro that expands to a time range filter on the specified column, based on the time picker in the dashboard UI. This replaces the need to manually write TIMESTAMP > $__timeFrom AND TIMESTAMP < $__timeTo.

Filter by Instance

SELECT
    TIMESTAMP AS time,
    VALUE['SEVERITY_TEXT']::STRING AS level,
    VALUE['MESSAGE']::STRING AS message
FROM POSTGRES_LOGS
WHERE $__timeFilter(TIMESTAMP)
  AND RESOURCE_ATTRIBUTES['instance.id']::STRING = '<YOUR_INSTANCE_ID>'
ORDER BY TIMESTAMP DESC

Errors and Warnings Only

SELECT
    TIMESTAMP AS time,
    VALUE['SEVERITY_TEXT']::STRING AS level,
    VALUE['MESSAGE']::STRING AS message
FROM POSTGRES_LOGS
WHERE $__timeFilter(TIMESTAMP)
  AND VALUE['SEVERITY_TEXT']::STRING IN ('ERROR', 'FATAL', 'PANIC', 'WARNING')
ORDER BY TIMESTAMP DESC

8. Build a Postgres Monitoring Dashboard

Panel: Log Volume Over Time

SELECT
    TIME_SLICE(TIMESTAMP, 5, 'MINUTE') AS time,
    COUNT(*) AS log_count
FROM POSTGRES_LOGS
WHERE $__timeFilter(TIMESTAMP)
GROUP BY time
ORDER BY time;

Panel: Log Volume by Severity

SELECT
    TIME_SLICE(TIMESTAMP, 5, 'MINUTE') AS time,
    VALUE['SEVERITY_TEXT']::STRING AS level,
    COUNT(*) AS log_count
FROM POSTGRES_LOGS
WHERE $__timeFilter(TIMESTAMP)
GROUP BY time, level
ORDER BY time;

Panel: Error Log Feed

SELECT
    TIMESTAMP AS time,
    VALUE['SEVERITY_TEXT']::STRING AS level,
    VALUE['MESSAGE']::STRING AS message,
    RESOURCE_ATTRIBUTES['instance.id']::STRING AS instance_id
FROM POSTGRES_LOGS
WHERE $__timeFilter(TIMESTAMP)
  AND VALUE['SEVERITY_TEXT']::STRING IN ('ERROR', 'FATAL', 'PANIC')
ORDER BY TIMESTAMP DESC
LIMIT 100;

Panel: Connections Over Time

SELECT
    TIME_SLICE(TIMESTAMP, 5, 'MINUTE') AS time,
    COUNT(*) AS connections
FROM POSTGRES_LOGS
WHERE $__timeFilter(TIMESTAMP)
  AND VALUE['MESSAGE']::STRING ILIKE '%connection authorized%'
GROUP BY time
ORDER BY time;

Panel: Slow Queries

SELECT
    TIMESTAMP AS time,
    VALUE['MESSAGE']::STRING AS message,
    RESOURCE_ATTRIBUTES['instance.id']::STRING AS instance_id
FROM POSTGRES_LOGS
WHERE $__timeFilter(TIMESTAMP)
  AND VALUE['MESSAGE']::STRING ILIKE '%duration:%'
ORDER BY TIMESTAMP DESC
LIMIT 50;

Dashboard Variable: Instance Picker

SELECT DISTINCT RESOURCE_ATTRIBUTES['instance.id']::STRING AS instance_id
FROM POSTGRES_LOGS
WHERE TIMESTAMP > DATEADD('day', -1, CURRENT_TIMESTAMP())

9. Set Up Alerts

Alert: Error Spike

SELECT
    COUNT(*) AS error_count
FROM POSTGRES_LOGS
WHERE TIMESTAMP > DATEADD('minute', -5, CURRENT_TIMESTAMP())
  AND VALUE['SEVERITY_TEXT']::STRING IN ('ERROR', 'FATAL', 'PANIC')

Alert: FATAL or PANIC Events

SELECT
    COUNT(*) AS critical_count
FROM POSTGRES_LOGS
WHERE TIMESTAMP > DATEADD('minute', -5, CURRENT_TIMESTAMP())
  AND VALUE['SEVERITY_TEXT']::STRING IN ('FATAL', 'PANIC')

Evaluation interval: Grafana evaluates alert rules on a schedule. Set the evaluation interval to match how frequently you want checks to run (e.g., every 1 or 5 minutes). Keep in mind that each evaluation runs a query against your Snowflake warehouse.

Conclusion and Resources

What You Learned

Resources