Date: Thu, 7 May 2015 16:49:27 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter_e@gmx.net>
Cc: Fujii Masao <masao.fujii@gmail.com>,
 Sawada Masahiko <sawada.mshk@gmail.com>,
 David Steele <david@pgmasters.net>, Simon Riggs <simon@2ndquadrant.com>,
 Tatsuo Ishii <ishii@postgresql.org>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>,
 Abhijit Menon-Sen <ams@2ndquadrant.com>
Subject: Re: Auditing extension for PostgreSQL (Take 2)
Message-ID: <20150507204927.GD30322@tamriel.snowman.net>
References: <553FA477.5010803@pgmasters.net>
 <CAD21AoCQSGZ5x+sfs4g1x_8Fip60x8ULQFTAGB5XTrKQZvPWPA@mail.gmail.com>
 <CAHGQGwGJnRW69rSL1=tza571_eA44hBeChg-NAVrqQytESgvLg@mail.gmail.com>
 <55443ED1.6070003@gmx.net>
 <20150504190035.GO30322@tamriel.snowman.net>
 <5548095A.1040900@gmx.net>
 <20150505003719.GQ30322@tamriel.snowman.net>
 <5549172B.70005@gmx.net>
 <20150507142655.GW30322@tamriel.snowman.net>
 <554BCE32.7010709@gmx.net>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="+SjOtuBPz8meD6md"
Content-Disposition: inline
In-Reply-To: <554BCE32.7010709@gmx.net>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--+SjOtuBPz8meD6md
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Peter,

* Peter Eisentraut (peter_e@gmx.net) wrote:
> On 5/7/15 10:26 AM, Stephen Frost wrote:
> > Auditing is about "what happened" whereas
> > statement logging is "log whatever statement the user sent."  pgAudit
> > bears this out by logging internal SQL statements and object
> > information, unlike what we do with statement logging today.
>=20
> I don't think this is quite correct.  For example,
> log_min_duration_statement logs based on what happened.  log_duration
> records what happened.  log_checkpoints records what happened.
> log_statement also requires parsing before deciding whether to log.

I'm not sure I agree, but it seems a relatively minor point (please
correct me if you feel differently).  You're certainly correct that
log_min_duration_statement allows filtering of the statement logging
based on what happened, but it's still statement logging.  The other log
options are more in-line with "what happened" kind of logging, but they
also aren't user activity, so perhaps rephrasing my statement along the
lines of "what happened based on user activity" would make more sense.
On the other hand, log_checkpoints isn't "statement" or "session"
logging, which is what we had been discussing, I thought.

I agree that log_duration is more in-line with "what happened".

> Generally, "logging" is "what happened".  The stuff in syslog is what
> happened on the system.

Agreed, but I had thought we were primairly focusing on session /
statement logging, which is the potential overlap in capability being
discussed as related to pgAudit (I don't expect pgAudit to ever include
checkpoint logging, for example).  My email to Bruce, I believe,
clarifies how I've been thinking about statement/session logging and the
more general category of "logging" (which auditing certainly falls under
also, as "audit logging").

	Thanks!

		Stephen

--+SjOtuBPz8meD6md
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVS8/XAAoJEO1sijiDR2RV3wAP/1zHXYKnlHa9g6HvUOgiyCOp
TgEiE/YiBqAjFXEYul04D/31wGOtSLTVvNO7SMdNBFRlITBZhLep+Lzj7W/wISev
j3ZT+ZJuslwnct6XZ4QXVFF3zjIgSWQI5hePm9rYZxfGkC25VGTPY6YobaAx4ddP
E9bWckoyGaaDrOc9BruzVK8CWr95HSEsSJ2ZkpbQUgy+WEinlNGiSd7TKpdo3Zhd
PiRK30TGVfcErQPPR3YUDjBDe6zY9yDwx59Z8ZdrJwX8zSqlbbxHIwpXF52DSnOm
PvPKCCiGDd5x+VR5f16J0/bSj6SYHwDli3qC+Qv/z1BwSnqisPGHx/Mg1v7Xp2jp
hnmVlMlYfOD69jbDV0BXziRykIVqb3k80VN+x+oau8kqi/fbCpTRs3og+TXl5La5
fCB8J8c/Z8pkC4eZ1IWtLFVG31K6dClF9Frn8+iYC0YPbeHZGnClp+WhvDtqI9Ax
2LU8A6Ckux1OKXiJb+2v06MwO9E7m75PnQslX7nrXlyMLqHhCFdAhc7TWCkx4WZF
bLA3xU5aVap16hsGNds0Or0bYzyx6Jvrg510eEAOsk+F0n1hj287KLYKofM/UUPq
gFU9W42Ck5BfWfZf5MYrWBi07+tufe9ym9S5vuXfTgtCLEPxEXkihPxxzAvnw8KA
zvHhFD1L62QboBQRpH68
=FMta
-----END PGP SIGNATURE-----

--+SjOtuBPz8meD6md--