MIME-Version: 1.0
From: Lok P <loknath.73@gmail.com>
Date: Sat, 20 Apr 2024 19:32:39 +0530
Message-ID: <CAKna9VZZuGwejSd+u9gQ7WobDYDcip+2Ua5e67sKA-Wgah=7Wg@mail.gmail.com>
Subject: Logging statement having any threat?
To: pgsql-general <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000f18b0f061687a808"
Archived-At: <https://www.postgresql.org/message-id/CAKna9VZZuGwejSd%2Bu9gQ7WobDYDcip%2B2Ua5e67sKA-Wgah%3D7Wg%40mail.gmail.com>
Precedence: bulk

--000000000000f18b0f061687a808
Content-Type: text/plain; charset="UTF-8"

Hello All,
Its postgres version 15.4 and its RDS, in which our dev team gets the
infrastructure code from another third party team which provides us base
infrastructure code to build a postgres database, in which we will be able
to do change DB parameter values etc whatever is mentioned in the file with
possible values. But surprisingly we don't see log_statement there. Below
was our requirement,

For debugging and evaluating performance we were having pg_stat_statements
but it contains aggregated information about all the query execution. But
in case just want to debug any point in time issues where the selected few
queries were performing bad (may be because of plan change), we were
planning to have the auto_explain extension added and set the
log_min_duration to ~5 seconds, So that, all the queries going above that
time period(5 seconds) will be logged and provide detailed information on
the exact point of bottleneck. But we see the log_statement parameter has
been removed from the base infrastructure script/terraform script given by
the database team here, so that means we will get it as default which is
"NONE", which means no statement(SELECT/DML/DDL etc) can be logged.

Now when we reach out to the infrastructure team , they are saying these
variables(pg_cluster_log_statement,pg_instance_log_statement) were removed
due to potential security threat. So I want to understand from experts here
, how this is really a security threat and if any option to get this
logging enabled (which will help us debug performance issues) at same time
addressing the threat too?

Regards
Lok

--000000000000f18b0f061687a808
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello All,<div>Its postgres version 15.4 and its RDS, in w=
hich our dev team gets the infrastructure code from another third party tea=
m which provides us base infrastructure code to build a postgres database, =
in which we will be able to do change DB parameter values etc whatever is m=
entioned in the file with possible values. But surprisingly we don&#39;t se=
e log_statement there. Below was our requirement,<br><br>For debugging and =
evaluating performance we were having pg_stat_statements but it contains ag=
gregated information about all the query execution. But in case just want t=
o debug any point in time issues where the selected few queries were perfor=
ming bad (may be because of plan change), we were planning to have the auto=
_explain extension added and set the log_min_duration to ~5 seconds, So tha=
t, all the queries going above that time period(5 seconds) will be logged a=
nd provide detailed information on the exact point of bottleneck. But we se=
e the log_statement parameter has been removed from the base infrastructure=
 script/terraform script given by the database team here, so that means we =
will get it as default which is &quot;NONE&quot;, which means no statement(=
SELECT/DML/DDL etc) can be logged. <br><br>Now when we reach out to the inf=
rastructure team , they are saying these variables(pg_cluster_log_statement=
,pg_instance_log_statement) were removed due to potential security threat. =
So I want to understand from experts here , how this is really a security t=
hreat and if any option to get this logging enabled (which will help us deb=
ug performance issues) at same time addressing the threat too?<br><div><br>=
</div><div>Regards=C2=A0</div><div>Lok</div></div></div>

--000000000000f18b0f061687a808--