From: David Steele <david@pgmasters.net>
To: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter_e@gmx.net>
Cc: Fujii Masao <masao.fujii@gmail.com>
Cc: Sawada Masahiko <sawada.mshk@gmail.com>
Cc: Simon Riggs <simon@2ndquadrant.com>
Cc: Tatsuo Ishii <ishii@postgresql.org>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Cc: Abhijit Menon-Sen <ams@2ndquadrant.com>
Subject: Re: Auditing extension for PostgreSQL (Take 2)
Date: Thu, 07 May 2015 09:21:13 -0600
Message-ID: <554B82E9.1040408@pgmasters.net> (raw)
In-Reply-To: <20150507142655.GW30322@tamriel.snowman.net>
References: <553938A1.7030707@pgmasters.net>
<CAD21AoDBt44ABM_0WMketM8bZtqLBMrJpd9RD5tE=Dkr57ft_A@mail.gmail.com>
<553FA477.5010803@pgmasters.net>
<CAD21AoCQSGZ5x+sfs4g1x_8Fip60x8ULQFTAGB5XTrKQZvPWPA@mail.gmail.com>
<CAHGQGwGJnRW69rSL1=tza571_eA44hBeChg-NAVrqQytESgvLg@mail.gmail.com>
<55443ED1.6070003@gmx.net>
<20150504190035.GO30322@tamriel.snowman.net>
<5548095A.1040900@gmx.net>
<20150505003719.GQ30322@tamriel.snowman.net>
<5549172B.70005@gmx.net>
<20150507142655.GW30322@tamriel.snowman.net>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On 5/7/15 8:26 AM, Stephen Frost wrote:
> * Peter Eisentraut (peter_e@gmx.net) wrote:
>> On 5/4/15 8:37 PM, Stephen Frost wrote:
>>> I don't follow this logic. The concerns raised above are about changing
>>> our in-core logging. We haven't got in-core auditing and so I don't see
>>> how they apply to it.
>>
>> How is session "auditing" substantially different from statement logging?
>
> David had previously outlined the technical differences between the
> statement logging we have today and what pgAudit does, but I gather
> you're asking about it definitionally, though it ends up amounting to
> much the same to me. Auditing is about "what happened" whereas
> statement logging is "log whatever statement the user sent." pgAudit
> bears this out by logging internal SQL statements and object
> information, unlike what we do with statement logging today.
That's a great way to describe it and I'll see if I can incorporate this
idea into the docs to hopefully make the topic a bit clearer.
>> I think it is not, and we could tweak the logging facilities a bit to
>> satisfy the audit trail case while making often-requested enhancement to
>> the traditional logging use case as well at the same time.
>
> Changing our existing statement logging to be a "what happened" auditing
> system is possible, but I don't see it as a "tweak."
Agreed - not the least of which would be figuring out a more detailed
statement classification system for core which would probably be the
first step.
> Lastly, from the perspective of the session logging piece, the code
> footprint for that in pgAudit isn't the bulk or even terribly
> significant, most of the code would still be required for the object
> auditing capability.
Both have a decent footprint but also a lot in common so it's fair to
say that removing session audit logging would not reduce the amount of
code significantly.
--
- David Steele
david@pgmasters.net
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: david@pgmasters.net, sfrost@snowman.net, peter_e@gmx.net, masao.fujii@gmail.com, sawada.mshk@gmail.com, simon@2ndquadrant.com, ishii@postgresql.org, ams@2ndquadrant.com
Subject: Re: Auditing extension for PostgreSQL (Take 2)
In-Reply-To: <554B82E9.1040408@pgmasters.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox