From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nikolay Samokhvalov <samokhvalov@gmail.com>
cc: Holger Jakobs <holger@jakobs.com>, Daulat <daulat.dba@gmail.com>,
        pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: How to Log DBA actions
In-reply-to: 
 <CANNMO+KgsBbS6BENrD_z-_oPu_SNPXAp-00vYNg68N=9TUBVUg@mail.gmail.com>
References: 
 <CALfOM6LVK2cPspzoihzp7mdr4-SaKJadvD6v+eJWbzkQth2-Rg@mail.gmail.com>
 <BF9C0B0F-44FD-4377-BF63-D7ABC6B0FDB3@jakobs.com>
 <CANNMO+KgsBbS6BENrD_z-_oPu_SNPXAp-00vYNg68N=9TUBVUg@mail.gmail.com>
Comments: In-reply-to Nikolay Samokhvalov <samokhvalov@gmail.com>
	message dated "Tue, 21 Dec 2021 13:25:36 -0800"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <161735.1640122282.1@sss.pgh.pa.us>
Date: Tue, 21 Dec 2021 16:31:22 -0500
Message-ID: <161736.1640122282@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/161736.1640122282%40sss.pgh.pa.us>
Precedence: bulk

Nikolay Samokhvalov <samokhvalov@gmail.com> writes:
> On Sun, Dec 19, 2021 at 10:43 PM Holger Jakobs <holger@jakobs.com> wrote:
>> There is a setting log_statements which can be set to none (the default),
>> ddl, mod or all

> ..and, unfortunately, any user will be able to set it back via SET.

Really?

regression=# create user joe;
CREATE ROLE
regression=# \c - joe
You are now connected to database "regression" as user "joe".
regression=> set log_statement = none;
ERROR:  permission denied to set parameter "log_statement"

It is true that superusers can change that variable.  However, if
you are trying to force monitoring of an uncooperative superuser,
you are in for a hard slog.

			regards, tom lane