Message-ID: <554B82E9.1040408@pgmasters.net>
Date: Thu, 07 May 2015 09:21:13 -0600
From: David Steele <david@pgmasters.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10;
 rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: Stephen Frost <sfrost@snowman.net>,
 Peter Eisentraut <peter_e@gmx.net>
CC: Fujii Masao <masao.fujii@gmail.com>,
 Sawada Masahiko <sawada.mshk@gmail.com>,
 Simon Riggs <simon@2ndquadrant.com>, Tatsuo Ishii <ishii@postgresql.org>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>,
 Abhijit Menon-Sen <ams@2ndquadrant.com>
Subject: Re: Auditing extension for PostgreSQL (Take 2)
References: <553938A1.7030707@pgmasters.net>
 <CAD21AoDBt44ABM_0WMketM8bZtqLBMrJpd9RD5tE=Dkr57ft_A@mail.gmail.com>
 <553FA477.5010803@pgmasters.net>
 <CAD21AoCQSGZ5x+sfs4g1x_8Fip60x8ULQFTAGB5XTrKQZvPWPA@mail.gmail.com>
 <CAHGQGwGJnRW69rSL1=tza571_eA44hBeChg-NAVrqQytESgvLg@mail.gmail.com>
 <55443ED1.6070003@gmx.net> <20150504190035.GO30322@tamriel.snowman.net>
 <5548095A.1040900@gmx.net> <20150505003719.GQ30322@tamriel.snowman.net>
 <5549172B.70005@gmx.net> <20150507142655.GW30322@tamriel.snowman.net>
In-Reply-To: <20150507142655.GW30322@tamriel.snowman.net>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="tdAKFKU3ONcgwW4Dju43vpdmVF2nk0UnM"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--tdAKFKU3ONcgwW4Dju43vpdmVF2nk0UnM
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

On 5/7/15 8:26 AM, Stephen Frost wrote:
> * Peter Eisentraut (peter_e@gmx.net) wrote:
>> On 5/4/15 8:37 PM, Stephen Frost wrote:
>>> I don't follow this logic.  The concerns raised above are about chang=
ing
>>> our in-core logging.  We haven't got in-core auditing and so I don't =
see
>>> how they apply to it.
>>
>> How is session "auditing" substantially different from statement loggi=
ng?
>=20
> David had previously outlined the technical differences between the
> statement logging we have today and what pgAudit does, but I gather
> you're asking about it definitionally, though it ends up amounting to
> much the same to me.  Auditing is about "what happened" whereas
> statement logging is "log whatever statement the user sent."  pgAudit
> bears this out by logging internal SQL statements and object
> information, unlike what we do with statement logging today.

That's a great way to describe it and I'll see if I can incorporate this
idea into the docs to hopefully make the topic a bit clearer.

>> I think it is not, and we could tweak the logging facilities a bit to
>> satisfy the audit trail case while making often-requested enhancement =
to
>> the traditional logging use case as well at the same time.
>=20
> Changing our existing statement logging to be a "what happened" auditin=
g
> system is possible, but I don't see it as a "tweak."

Agreed - not the least of which would be figuring out a more detailed
statement classification system for core which would probably be the
first step.

> Lastly, from the perspective of the session logging piece, the code
> footprint for that in pgAudit isn't the bulk or even terribly
> significant, most of the code would still be required for the object
> auditing capability.

Both have a decent footprint but also a lot in common so it's fair to
say that removing session audit logging would not reduce the amount of
code significantly.

--=20
- David Steele
david@pgmasters.net


--tdAKFKU3ONcgwW4Dju43vpdmVF2nk0UnM
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJVS4LpAAoJEIA2uIJQ5SFAVQQP/jV1Clikz65kGAqsw5aReENz
SGtmpMUfrP6p1UCV4aFDU+ecmG5R23cseEmouVsTL9dSIyTaG/nSfgCE99nj9ZQM
CabiQ68IfIaaUu9FASGjWMLQKvpmU8IzhFBNe7x+bMtrACAk4BVfNa++QlXaUn9i
bf4stybLrWiqcDnJai0QSeS+otf0nLCYwrWxpBQoYu2yUkv0hIp5gUJBNjZ01Htv
2ZTkPpd3Byt3mlEUceJ7FRX8yf8/tjovYLyGNnYb3kUS9pZrZt7p/pUbefKQlEyU
64wAJQBfTVWXxcQySUaulQiBQrEkfJrUZWNovSkHiQ95LD94RVSo21/3BeYtbswP
N9xdflr9OXds+VSCZASjASKRaTmJwdui29lOcS4xOzpoDSgj0XN/Lkzlpc5Qu/nx
5oe1f8O7DDbAuIlayKFAMJTkwz5D6Xuid7JE8HcUfdGK6g4uSmL49BcZHT3IpOqh
CLg6AJeUoRRY6ibG+xXue2iSVqeDpAzNrefQDtk1vPrOVWbBSobMBxtSvawgsx+Z
13q4CrOclF+eN6bI8PusGagrHALTjrYWxeSZsY9Q60CYaDEM26eSdCZv1AeLnjkQ
+HpxxQI+Qmp3fDni1q4NsMZ1e5ABBQibqpfjsbXXtaDd5J2k4Ofk1yyqtyAnhvK7
sHUD175RWxjKMoKIInaq
=9yCC
-----END PGP SIGNATURE-----

--tdAKFKU3ONcgwW4Dju43vpdmVF2nk0UnM--