From: David Steele <david@pgmasters.net>
To: Sawada Masahiko <sawada.mshk@gmail.com>
Cc: Tatsuo Ishii <ishii@postgresql.org>
Cc: Simon Riggs <simon@2ndquadrant.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Cc: Abhijit Menon-Sen <ams@2ndquadrant.com>
Cc: Fujii Masao <masao.fujii@gmail.com>
Subject: Re: Auditing extension for PostgreSQL (Take 2)
Date: Mon, 20 Apr 2015 09:17:34 -0400
Message-ID: <5534FC6E.9030906@pgmasters.net> (raw)
In-Reply-To: <CAD21AoBoS6Q5yjB05LpfKTzhKmarqwwVq06fuPDFsm0T8gSk_Q@mail.gmail.com>
References: <552326EE.4060509@pgmasters.net>
<CA+U5nMJkT0ZR3ZD-NhqX=OAfpMJak2ORUE4q=3+zFHay6yuTNw@mail.gmail.com>
<552D2C1A.3060002@pgmasters.net>
<20150415.081354.1167351714960358354.t-ishii@sraoss.co.jp>
<552DA959.2010102@pgmasters.net>
<CAD21AoDUG8G90SUo70JL=AKDA4dXGNb_wAc4-MvxtwvuMRO0kA@mail.gmail.com>
<CAD21AoCdr6R7T-PuAQf7S70c6qqX1JvBV55idbfcPtz_tEZ5hQ@mail.gmail.com>
<552EA121.1090603@pgmasters.net>
<CAD21AoBoS6Q5yjB05LpfKTzhKmarqwwVq06fuPDFsm0T8gSk_Q@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On 4/20/15 4:40 AM, Sawada Masahiko wrote:
>
> Thank you for updating the patch.
>
> One question about regarding since v7 (or later) patch is;
> What is the different between OBJECT logging and SESSION logging?
In brief, session logging can log anything that happens in a user
session while object logging only targets DML and SELECT on selected
relations.
The pg_audit.log_relation setting is intended to mimic the prior
behavior of pg_audit before object logging was added.
In general, I would not expect pg_audit.log = 'read, write' to be used
with pg_audit.role. In other words, session logging of DML and SELECT
should probably not be turned on at the same time as object logging is
in use. Object logging is intended to be a fine-grained version of
pg_audit.log = 'read, write' (one or both).
> I used v9 patch with "pg_audit.log_relation = on", and got quite
> similar but different log as follows.
>
> =# select * from hoge, bar where hoge.col = bar.col;
> NOTICE: AUDIT: OBJECT,8,1,READ,SELECT,TABLE,public.hoge,"select *
> from hoge, bar where hoge.col = bar.col;"
> NOTICE: AUDIT: SESSION,8,1,READ,SELECT,TABLE,public.hoge,"select *
> from hoge, bar where hoge.col = bar.col;"
> NOTICE: AUDIT: OBJECT,8,1,READ,SELECT,TABLE,public.bar,"select * from
> hoge, bar where hoge.col = bar.col;"
> NOTICE: AUDIT: SESSION,8,1,READ,SELECT,TABLE,public.bar,"select *
> from hoge, bar where hoge.col = bar.col;"
>
> The behaviour of SESSION log is similar to OBJECT log now, and SESSION
> log per session (i.g, pg_audit.log_relation = off) is also similar to
> 'log_statement = all'. (enhancing log_statement might be enough)
> So I couldn't understand needs of SESSION log.
Session logging is quite different from 'log_statement = all'. See:
http://www.postgresql.org/message-id/552323B2.8060708@pgmasters.net
and/or the "Why pg_audit?" section of the pg_audit documentation.
I agree that it may make sense in the future to merge session logging
into log_statements, but for now it does provide important additional
functionality for creating audit logs.
Regards,
--
- David Steele
david@pgmasters.net
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: david@pgmasters.net, sawada.mshk@gmail.com, ishii@postgresql.org, simon@2ndquadrant.com, ams@2ndquadrant.com, masao.fujii@gmail.com
Subject: Re: Auditing extension for PostgreSQL (Take 2)
In-Reply-To: <5534FC6E.9030906@pgmasters.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox