pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedWhat happens when PostgreSQL fails to log to SYSLOG
5+ messages / 4 participants
[nested] [flat]
* What happens when PostgreSQL fails to log to SYSLOG
@ 2012-07-10 20:08 Arnold, Sandra <ArnoldS@osti.gov>
2012-07-10 20:31 ` Re: What happens when PostgreSQL fails to log to SYSLOG Joshua D. Drake <jd@commandprompt.com>
0 siblings, 1 reply; 5+ messages in thread
From: Arnold, Sandra @ 2012-07-10 20:08 UTC (permalink / raw)
To: pgsql-admin
I am trying to find out what PostgreSQL does when it cannot write to its SYSLOG file, whether it is permissions or the file system where the log resides is full is the problem. Does PostgreSQL stall, does it rollback the transaction it cannot log to the SYSLOG, or does it continue on as if there is not an issue? I am writing Security controls and since I am using the SYSLOG for auditing purposes and I need to document what happens in case there was a failure in writing to the SYSLOG. For instance, Oracle rollbacks any transactions that are being audited it cannot write to its audit logs. Just want to know what PostgreSQL does.
Thanks,
Sandra Arnold
Senior Database Administrator
Contractor to DOE/OSTI
Information International Associates (IIA)
Oak Ridge, TN
(865) 576-0054 (work)
(865) 567-7553 (cell)
arnolds@osti.gov<mailto:arnolds@osti.gov>
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: What happens when PostgreSQL fails to log to SYSLOG
2012-07-10 20:08 What happens when PostgreSQL fails to log to SYSLOG Arnold, Sandra <ArnoldS@osti.gov>
@ 2012-07-10 20:31 ` Joshua D. Drake <jd@commandprompt.com>
2012-07-11 17:47 ` Re: What happens when PostgreSQL fails to log to SYSLOG Arnold, Sandra <ArnoldS@osti.gov>
0 siblings, 1 reply; 5+ messages in thread
From: Joshua D. Drake @ 2012-07-10 20:31 UTC (permalink / raw)
To: Arnold, Sandra <ArnoldS@osti.gov>; +Cc: pgsql-admin
On 07/10/2012 01:08 PM, Arnold, Sandra wrote:
> I am trying to find out what PostgreSQL does when it cannot write to its
> SYSLOG file, whether it is permissions or the file system where the log
> resides is full is the problem.
PostgreSQL doesn't write to a SYSLOG file. It sends it to the syslog
daemon. (if you are indeed using syslog)
> Does PostgreSQL stall, does it rollback
> the transaction it cannot log to the SYSLOG, or does it continue on as
> if there is not an issue?
This is a non-issue in terms of transactions and operations.
> I am writing Security controls and since I am
> using the SYSLOG for auditing purposes and I need to document what
> happens in case there was a failure in writing to the SYSLOG. For
> instance, Oracle rollbacks any transactions that are being audited it
> cannot write to its audit logs. Just want to know what PostgreSQL does.
>
You should probably look at tablelog for auditing. It automates it.
Syslog is not really a good way to handle that.
Sincerely,
Joshua D. Drake
--
Command Prompt, Inc. - http://www.commandprompt.com/
PostgreSQL Support, Training, Professional Services and Development
The PostgreSQL Conference - http://www.postgresqlconference.org/
@cmdpromptinc - @postgresconf - 509-416-6579
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: What happens when PostgreSQL fails to log to SYSLOG
2012-07-10 20:08 What happens when PostgreSQL fails to log to SYSLOG Arnold, Sandra <ArnoldS@osti.gov>
2012-07-10 20:31 ` Re: What happens when PostgreSQL fails to log to SYSLOG Joshua D. Drake <jd@commandprompt.com>
@ 2012-07-11 17:47 ` Arnold, Sandra <ArnoldS@osti.gov>
2012-07-11 18:26 ` Re: What happens when PostgreSQL fails to log to SYSLOG Tom Lane <tgl@sss.pgh.pa.us>
2012-07-11 20:07 ` Re: What happens when PostgreSQL fails to log to SYSLOG Craig James <cjames@emolecules.com>
0 siblings, 2 replies; 5+ messages in thread
From: Arnold, Sandra @ 2012-07-11 17:47 UTC (permalink / raw)
To: 'Joshua D. Drake' <jd@commandprompt.com>; +Cc: pgsql-admin
Tablelog would be ok for keeping up with transactions for tables. However, we also need to audit who connects successfully and unsuccessfully. As far as I am aware, if a user fails to log in successfully, say three times, PostgreSQL is not able to lock the account for 9.0. Is this the case for 9.1 as well? This is the version that I will be installing that I am writing the Security controls for. There are several events that I have to Audit and table transactions are just a small part of it. The events I need to audit are listed below:
- Unauthorized User Access
- Changes to User Privileges
- Changes to Audit Policy
- Reset User Password
- New User created in Database
- Users dropped from Database
- Invalid Login Attempts
Sandra Arnold
Senior Database Administrator
Contractor to DOE/OSTI
Information International Associates (IIA)
-----Original Message-----
From: Joshua D. Drake [mailto:jd@commandprompt.com]
Sent: Tuesday, July 10, 2012 4:31 PM
To: Arnold, Sandra
Cc: pgsql-admin@postgresql.org
Subject: Re: [ADMIN] What happens when PostgreSQL fails to log to SYSLOG
On 07/10/2012 01:08 PM, Arnold, Sandra wrote:
> I am trying to find out what PostgreSQL does when it cannot write to
> its SYSLOG file, whether it is permissions or the file system where
> the log resides is full is the problem.
PostgreSQL doesn't write to a SYSLOG file. It sends it to the syslog daemon. (if you are indeed using syslog)
> Does PostgreSQL stall, does it rollback the transaction it cannot log
> to the SYSLOG, or does it continue on as if there is not an issue?
This is a non-issue in terms of transactions and operations.
> I am writing Security controls and since I am using the SYSLOG for
> auditing purposes and I need to document what happens in case there
> was a failure in writing to the SYSLOG. For instance, Oracle
> rollbacks any transactions that are being audited it cannot write to
> its audit logs. Just want to know what PostgreSQL does.
>
You should probably look at tablelog for auditing. It automates it.
Syslog is not really a good way to handle that.
Sincerely,
Joshua D. Drake
--
Command Prompt, Inc. - http://www.commandprompt.com/ PostgreSQL Support, Training, Professional Services and Development The PostgreSQL Conference - http://www.postgresqlconference.org/
@cmdpromptinc - @postgresconf - 509-416-6579
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: What happens when PostgreSQL fails to log to SYSLOG
2012-07-10 20:08 What happens when PostgreSQL fails to log to SYSLOG Arnold, Sandra <ArnoldS@osti.gov>
2012-07-10 20:31 ` Re: What happens when PostgreSQL fails to log to SYSLOG Joshua D. Drake <jd@commandprompt.com>
2012-07-11 17:47 ` Re: What happens when PostgreSQL fails to log to SYSLOG Arnold, Sandra <ArnoldS@osti.gov>
@ 2012-07-11 18:26 ` Tom Lane <tgl@sss.pgh.pa.us>
1 sibling, 0 replies; 5+ messages in thread
From: Tom Lane @ 2012-07-11 18:26 UTC (permalink / raw)
To: Arnold, Sandra <ArnoldS@osti.gov>; +Cc: 'Joshua D. Drake' <jd@commandprompt.com>; pgsql-admin
"Arnold, Sandra" <ArnoldS@osti.gov> writes:
> Tablelog would be ok for keeping up with transactions for tables.
> However, we also need to audit who connects successfully and
> unsuccessfully. As far as I am aware, if a user fails to log in
> successfully, say three times, PostgreSQL is not able to lock the
> account for 9.0.
If you want custom authorization rules like that, the usual
recommendation is to use PAM authentication; you can set up pretty much
anything you want with a few PAM modules.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: What happens when PostgreSQL fails to log to SYSLOG
2012-07-10 20:08 What happens when PostgreSQL fails to log to SYSLOG Arnold, Sandra <ArnoldS@osti.gov>
2012-07-10 20:31 ` Re: What happens when PostgreSQL fails to log to SYSLOG Joshua D. Drake <jd@commandprompt.com>
2012-07-11 17:47 ` Re: What happens when PostgreSQL fails to log to SYSLOG Arnold, Sandra <ArnoldS@osti.gov>
@ 2012-07-11 20:07 ` Craig James <cjames@emolecules.com>
1 sibling, 0 replies; 5+ messages in thread
From: Craig James @ 2012-07-11 20:07 UTC (permalink / raw)
To: Arnold, Sandra <ArnoldS@osti.gov>; +Cc: Joshua D. Drake <jd@commandprompt.com>; pgsql-admin
On Wed, Jul 11, 2012 at 10:47 AM, Arnold, Sandra <ArnoldS@osti.gov> wrote:
> Tablelog would be ok for keeping up with transactions for tables.
> However, we also need to audit who connects successfully and
> unsuccessfully. As far as I am aware, if a user fails to log in
> successfully, say three times, PostgreSQL is not able to lock the account
> for 9.0. Is this the case for 9.1 as well?
This is off topic for your question, but locking an account after a small
number of failures is a bad security practice. It's an invitation for a
denial-of-service attack. Anyone who knows anyone else's account name can
lock them out. Anyone who gets a list of accounts can lock up the whole
system.
Craig
> This is the version that I will be installing that I am writing the
> Security controls for. There are several events that I have to Audit and
> table transactions are just a small part of it. The events I need to audit
> are listed below:
>
> - Unauthorized User Access
> - Changes to User Privileges
> - Changes to Audit Policy
> - Reset User Password
> - New User created in Database
> - Users dropped from Database
> - Invalid Login Attempts
>
> Sandra Arnold
> Senior Database Administrator
> Contractor to DOE/OSTI
> Information International Associates (IIA)
>
>
>
> -----Original Message-----
> From: Joshua D. Drake [mailto:jd@commandprompt.com]
> Sent: Tuesday, July 10, 2012 4:31 PM
> To: Arnold, Sandra
> Cc: pgsql-admin@postgresql.org
> Subject: Re: [ADMIN] What happens when PostgreSQL fails to log to SYSLOG
>
>
> On 07/10/2012 01:08 PM, Arnold, Sandra wrote:
> > I am trying to find out what PostgreSQL does when it cannot write to
> > its SYSLOG file, whether it is permissions or the file system where
> > the log resides is full is the problem.
>
> PostgreSQL doesn't write to a SYSLOG file. It sends it to the syslog
> daemon. (if you are indeed using syslog)
>
> > Does PostgreSQL stall, does it rollback the transaction it cannot log
> > to the SYSLOG, or does it continue on as if there is not an issue?
>
> This is a non-issue in terms of transactions and operations.
>
>
> > I am writing Security controls and since I am using the SYSLOG for
> > auditing purposes and I need to document what happens in case there
> > was a failure in writing to the SYSLOG. For instance, Oracle
> > rollbacks any transactions that are being audited it cannot write to
> > its audit logs. Just want to know what PostgreSQL does.
> >
>
> You should probably look at tablelog for auditing. It automates it.
> Syslog is not really a good way to handle that.
>
> Sincerely,
>
> Joshua D. Drake
>
>
> --
> Command Prompt, Inc. - http://www.commandprompt.com/ PostgreSQL Support,
> Training, Professional Services and Development The PostgreSQL Conference -
> http://www.postgresqlconference.org/
> @cmdpromptinc - @postgresconf - 509-416-6579
>
>
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin
>
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2012-07-11 20:07 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2012-07-10 20:08 What happens when PostgreSQL fails to log to SYSLOG Arnold, Sandra <ArnoldS@osti.gov>
2012-07-10 20:31 ` Joshua D. Drake <jd@commandprompt.com>
2012-07-11 17:47 ` Arnold, Sandra <ArnoldS@osti.gov>
2012-07-11 18:26 ` Tom Lane <tgl@sss.pgh.pa.us>
2012-07-11 20:07 ` Craig James <cjames@emolecules.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox