From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nikolay Samokhvalov <samokhvalov@gmail.com>
Cc: Holger Jakobs <holger@jakobs.com>
Cc: Daulat <daulat.dba@gmail.com>
Cc: pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: How to Log DBA actions
Date: Tue, 21 Dec 2021 16:31:22 -0500
Message-ID: <161736.1640122282@sss.pgh.pa.us> (raw)
In-Reply-To: <CANNMO+KgsBbS6BENrD_z-_oPu_SNPXAp-00vYNg68N=9TUBVUg@mail.gmail.com>
References: <CALfOM6LVK2cPspzoihzp7mdr4-SaKJadvD6v+eJWbzkQth2-Rg@mail.gmail.com>
<BF9C0B0F-44FD-4377-BF63-D7ABC6B0FDB3@jakobs.com>
<CANNMO+KgsBbS6BENrD_z-_oPu_SNPXAp-00vYNg68N=9TUBVUg@mail.gmail.com>
Nikolay Samokhvalov <samokhvalov@gmail.com> writes:
> On Sun, Dec 19, 2021 at 10:43 PM Holger Jakobs <holger@jakobs.com> wrote:
>> There is a setting log_statements which can be set to none (the default),
>> ddl, mod or all
> ..and, unfortunately, any user will be able to set it back via SET.
Really?
regression=# create user joe;
CREATE ROLE
regression=# \c - joe
You are now connected to database "regression" as user "joe".
regression=> set log_statement = none;
ERROR: permission denied to set parameter "log_statement"
It is true that superusers can change that variable. However, if
you are trying to force monitoring of an uncooperative superuser,
you are in for a hard slog.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, samokhvalov@gmail.com, holger@jakobs.com, daulat.dba@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: How to Log DBA actions
In-Reply-To: <161736.1640122282@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox