Message-ID: <5534FC6E.9030906@pgmasters.net>
Date: Mon, 20 Apr 2015 09:17:34 -0400
From: David Steele <david@pgmasters.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10;
 rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: Sawada Masahiko <sawada.mshk@gmail.com>
CC: Tatsuo Ishii <ishii@postgresql.org>, Simon Riggs <simon@2ndquadrant.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>,
 Abhijit Menon-Sen <ams@2ndquadrant.com>,
 Fujii Masao <masao.fujii@gmail.com>
Subject: Re: Auditing extension for PostgreSQL (Take 2)
References: <552326EE.4060509@pgmasters.net>
 <CA+U5nMJkT0ZR3ZD-NhqX=OAfpMJak2ORUE4q=3+zFHay6yuTNw@mail.gmail.com>
 <552D2C1A.3060002@pgmasters.net>
 <20150415.081354.1167351714960358354.t-ishii@sraoss.co.jp>
 <552DA959.2010102@pgmasters.net>
 <CAD21AoDUG8G90SUo70JL=AKDA4dXGNb_wAc4-MvxtwvuMRO0kA@mail.gmail.com>
 <CAD21AoCdr6R7T-PuAQf7S70c6qqX1JvBV55idbfcPtz_tEZ5hQ@mail.gmail.com>
 <552EA121.1090603@pgmasters.net>
 <CAD21AoBoS6Q5yjB05LpfKTzhKmarqwwVq06fuPDFsm0T8gSk_Q@mail.gmail.com>
In-Reply-To: 
 <CAD21AoBoS6Q5yjB05LpfKTzhKmarqwwVq06fuPDFsm0T8gSk_Q@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="Lrk0LHqEnRwfA4WGWphIvAxnVaTFmaUCB"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--Lrk0LHqEnRwfA4WGWphIvAxnVaTFmaUCB
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 4/20/15 4:40 AM, Sawada Masahiko wrote:
>=20
> Thank you for updating the patch.
>=20
> One question about regarding since v7 (or later) patch is;
> What is the different between OBJECT logging and SESSION logging?

In brief, session logging can log anything that happens in a user
session while object logging only targets DML and SELECT on selected
relations.

The pg_audit.log_relation setting is intended to mimic the prior
behavior of pg_audit before object logging was added.

In general, I would not expect pg_audit.log =3D 'read, write' to be used
with pg_audit.role.  In other words, session logging of DML and SELECT
should probably not be turned on at the same time as object logging is
in use.  Object logging is intended to be a fine-grained version of
pg_audit.log =3D 'read, write' (one or both).

> I used v9 patch with "pg_audit.log_relation =3D on", and got quite
> similar but different log as follows.
>=20
> =3D# select * from hoge, bar where hoge.col =3D bar.col;
> NOTICE:  AUDIT: OBJECT,8,1,READ,SELECT,TABLE,public.hoge,"select *
> from hoge, bar where hoge.col =3D bar.col;"
> NOTICE:  AUDIT: SESSION,8,1,READ,SELECT,TABLE,public.hoge,"select *
> from hoge, bar where hoge.col =3D bar.col;"
> NOTICE:  AUDIT: OBJECT,8,1,READ,SELECT,TABLE,public.bar,"select * from
> hoge, bar where hoge.col =3D bar.col;"
> NOTICE:  AUDIT: SESSION,8,1,READ,SELECT,TABLE,public.bar,"select *
> from hoge, bar where hoge.col =3D bar.col;"
>=20
> The behaviour of SESSION log is similar to OBJECT log now, and SESSION
> log per session (i.g, pg_audit.log_relation =3D off) is also similar to=

> 'log_statement =3D all'. (enhancing log_statement might be enough)
> So I couldn't understand needs of SESSION log.

Session logging is quite different from 'log_statement =3D all'.  See:

http://www.postgresql.org/message-id/552323B2.8060708@pgmasters.net

and/or the "Why pg_audit?" section of the pg_audit documentation.

I agree that it may make sense in the future to merge session logging
into log_statements, but for now it does provide important additional
functionality for creating audit logs.

Regards,
--=20
- David Steele
david@pgmasters.net


--Lrk0LHqEnRwfA4WGWphIvAxnVaTFmaUCB
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJVNPxuAAoJEIA2uIJQ5SFAfSsP/2w96rxW7x/HtAG+1vKTk2zs
TBPe5Jz7omQ82bHVQxe7NwOoSjWhqR3YxE49+en3bIkR50RK42jq6L3eZsX6PQ4P
kVoBEYcGxQjiQloQowtKo86/4ghxo7yBc8cYDwXedHhtyfW6jSoJd00st7PHN7gO
3E7zP3Zxk7gC9zPf5ZFS0oUWj6Kim7HAH6CcD4hE5BFtVDpnLq0/ZsVwalDK2Qo2
SlIOfL7G7ioNoYeWS5xY8Im5Mi1sbkvc+gIycY/aW+WQmYwcAkDSAhsR9qR+EHZC
LWcCmMY2EdxnAJaIc4lze9odJBKpU5E5q5LuG1Z+ieuTkBGpgnV9BgnwmMK7Uwcs
RqNFsoC5agN8ss+J+NcZfiEb/KuArJhYA0x5RwYgk8I+Kz7JRJ/3wpxrqfxpg6JF
Ym1DL3EL4Z/BURBLo6edz4QjVhZrPmsWs+uN90R9NhB6xD8L4cWw9Jsb1uZS37m5
KeAGBwU03/ZAwpfbkOrBfDkF/pNZpjzy6GdBd06ovNFda6cIo5egUuBue5ZTqWZS
kje+AH53djYetZUDojH4Pxz11NV32z1dPCLS5/oD4kbxV+SUHsePRcOWPTuz/+4q
y9gxV6mBYwgzxzj0O+jVM1QLv9/q715M4JszHfL2+bXf4XyEuEhNI1HI30FojxzP
XPqp0zKGRs2h0l1xKxvg
=ZNkv
-----END PGP SIGNATURE-----

--Lrk0LHqEnRwfA4WGWphIvAxnVaTFmaUCB--