Date: Fri, 10 Mar 2017 08:56:56 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Tels <nospam-pg-abuse@bloodgate.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Robert Haas <robertmhaas@gmail.com>,
	Joe Conway <mail@joeconway.com>,
	"pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Upgrading postmaster's log messages about bind/listen
 errors
Message-ID: <20170310135656.GD9812@tamriel.snowman.net>
References: <9564.1489091245@sss.pgh.pa.us>
 <e3a1715d-dd25-d9bb-4a28-6839c242a2f7@joeconway.com>
 <CA+TgmoYpQiZMPHfQX8x8P+RqEq0XQBSb32QHTZ8dDwU+aP3qzg@mail.gmail.com>
 <19479.1489121003@sss.pgh.pa.us>
 <8371d0860a6019e5630bcdd2a96610ab.squirrel@sm.webmail.pair.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="8I2f9pApLMG3HqnG"
Content-Disposition: inline
In-Reply-To: <8371d0860a6019e5630bcdd2a96610ab.squirrel@sm.webmail.pair.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--8I2f9pApLMG3HqnG
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Tels (nospam-pg-abuse@bloodgate.com) wrote:
> On Thu, March 9, 2017 11:43 pm, Tom Lane wrote:
> > Robert Haas <robertmhaas@gmail.com> writes:
> >> On Thu, Mar 9, 2017 at 4:01 PM, Joe Conway <mail@joeconway.com> wrote:
> >>> +1 for making it LOG instead of DEBUG1
> >
> >> I would tend to vote against that, because startup is getting
> >> gradually chattier and chattier, and I think this isn't likely to be
> >> of interest to very many people most of the time.
> >
> > Yeah, my thought was that if we've gotten along without this for 20 yea=
rs,
> > it's probably not of interest to most people most of the time.
> >
> > However, if we're measuring this on a scale of usefulness to the average
> > DBA, I would argue that it's of more interest than any of these messages
> > that currently appear by default:
>=20
> My 0.02$:
>=20
> I'd argue that from a security standpoint it is important to log at
> startup what addresses the service binds to, just so it is visible,
> explicit and logged.

It's also terribly useful for realizing there's an issue.  I'd
definitely like to see what address we're binding to on startup in the
log and I agree that the other messages mentioned aren't nearly as
useful to the DBA.

Perhaps we could compromise by simply including the bind information in
the 'ready to accept connections' message, like so:

database system is ready to accept connections on (1.2.3.4)

Or something along those lines?

> Granted, there should be firewall rules preventing access, but
> misconfigurations, or simple changes can happen and go unnoticed. If later
> the postmaster bind address changes, maybe due to an update or human
> error,  you got the stars aligned just right for an unauthorized access.

I was helping someone with a "connection refused" message just this week
where it would have been quite helpful if the log had said which IP we
were binding on.

> OTOH, that the "logical replication launcher started" isn't really useful
> to know to me as a user, I'd rather know when it failed to launch.

Agreed.

Thanks!

Stephen

--8I2f9pApLMG3HqnG
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJYwrCnAAoJEO1sijiDR2RV4csQAMPQcohG/Fy3JC6KBtXMLE5X
YZolYDyJBArujSVcs6JKC8aG2N/IGdK35HshHM72ZGPnV6JnjXB/vn7FRMxKOXAn
pbxO/hV8EONnzvJ2nIj5uf3aaIIbvXTFqfdorNtLSQw1apm4hQBk42RIfNweqiQr
4GrWo9OZmuUbQepvoABzl2Wt0+gZrkfVqiCBHczKZx15se2tBodwjyhqM9+DeEG+
PRutfMAIEWul/9U/t1SSmgdIM4/FCQXw9TVUt78aZfAFIzahmzRdrI7fRsolMv5i
gWgEDIQzsoTzMh35ThPr7VYO5yMyHbX681uOfBZlWvCQr66f8aTr56NG2YiYi5w5
nEWBZrcXG0vyudQZR6sKHJMQNPIgRy4XmJTQxZD+MPeHIj5tWp93XdVdPZBMX8WZ
tWQPOI2jteTjyZ0bAp1F5w0S3NPSIeqmUTJ5cFU+fy0sk1KzyRCe34WnOE18YJmu
glu8mRg/06vWe+mMR5A6XYP/bo2qcGRzX7VWFAYijMcZoVp3Atekze5cnINam8l2
0Xb4GY7YqvVHtH59Ogn1KsXXc2cdSYCH3dIlgNJ6Roq/gyCX//u6FGUr0fEwqwCK
RQ05jXBOQLVXjHftH4cfjTK3fMr2QMaM7AZOnEJeRtknGxbu1U0xlLneb/mZukMK
ytEgTfYoCKq0WsoBrW3a
=8hRT
-----END PGP SIGNATURE-----

--8I2f9pApLMG3HqnG--