Postgres monitoring when you are the accidental DBA

Read the tiles without knowing the numbers

Colors follow fixed thresholds, so you can start without knowing what a healthy value looks like. The verdict equals the worst tile, and a line under it names the tiles behind it.

Tile	Red means	First thing to do
Blocked	3 sessions wait on a lock, or a chain of 3	Open Locks and look at the root blocker
Sessions	90% of max_connections in use	Open Activity and look for idle sessions
Longest query	A statement has run for 5 minutes	Open Activity, read its SQL, decide whether to stop it
Cache hit	Below 80% of reads come from memory	Check Slow queries for a large scan
Wraparound	75% of the way to Postgres refusing writes	Open Vacuum & Bloat, follow the causes it names
Replication	A standby is 5 minutes behind	Open Replication and read What the lag means

Autovacuum stops at amber: a table holds twice the dead rows that would start autovacuum on it. Slow queries carries no color because its averages describe the time since the last reset. Tap it anyway when the database feels slow: five checks, in order.

Connect your provider

Neon. Paste the connection string from the Connect panel. Direct and -pooler hosts both work, with verify-full.

Supabase. Paste the string from Connect. The direct host has only an IPv6 address; on a network without IPv6, HeapDeck shows This server is IPv6-only and points you to the Session pooler string.

Amazon RDS. Enter the instance endpoint from the RDS console, with sslmode=require. HeapDeck shows the certificate’s fingerprint once and pins it.

Anything else. Any PostgreSQL 13–18 your iPhone can reach should work: paste a postgres:// URI or a key=value string. For a private database, go through your SSH bastion. HeapDeck doesn’t support client certificates (mTLS).

When your role is missing rights

You don’t need superuser, and a missing privilege won’t leave you with a blank screen. Each screen marks what PostgreSQL hid, with <insufficient privilege> or needs pg_monitor, and Show me how gives you the command:

GRANT pg_monitor TO your_role;

Three cases come up on managed services:

• Other users’ SQL is hidden. That is pg_monitor. It grants reading only.
• You can’t stop someone else’s session. That takes pg_signal_backend or the rights of that role, which pg_monitor doesn’t include. The card reads Your role can't stop this session and gives you the command to pass on. Pro doesn’t change it.
• Slow queries says pg_stat_statements isn’t installed. The screen explains what to run. On RDS you enable the library in the parameter group, and Supabase has it on.

Three settings worth changing this week

Each one caps a failure this site covers: a runaway query, an abandoned transaction, a migration stuck in the lock queue. Set them per application role so migrations and manual work keep their own limits:

ALTER ROLE app SET statement_timeout = '30s';
ALTER ROLE app SET idle_in_transaction_session_timeout = '2min';
ALTER ROLE app SET lock_timeout = '5s';

Pick values above your slowest legitimate request. Pooled connections pick up the new settings when they reconnect.

When something is on fire

• Find the session blocking the others
• Kill a stuck query
• Fix too many clients already
• Understand idle in transaction
• Find what fills the disk

Each one has the SQL to run by hand, and the screen to open if you are on your phone. All of it is free to read on one server; stopping sessions and running VACUUM are part of HeapDeck Pro.

Questions

Can I monitor Postgres without superuser?

Yes. Grant your role pg_monitor and it can read all the monitoring views. Without it you still connect and see sessions and counts, but PostgreSQL hides the SQL of other users' sessions, and HeapDeck labels what it hides.

Can I monitor a Supabase database from my iPhone?

Yes. Paste the connection string from Supabase's Connect panel into HeapDeck. The direct host has only an IPv6 address, so on a network without IPv6 use the Session pooler string; HeapDeck tells you when this applies. pg_stat_statements is on already.

Does HeapDeck work with Neon?

Yes, over the direct host and the -pooler host, both with verify-full. Paste the string from Neon's Connect panel.

Does HeapDeck work with Amazon RDS?

Yes, and we checked it live. Enter the instance endpoint from the RDS console and use sslmode=require: RDS signs with its own root CA, which iOS doesn't ship, so HeapDeck pins the certificate's fingerprint on first connect.