Received: from maia.hub.org (unknown [200.46.208.211]) by mail.postgresql.org (Postfix) with ESMTP id 6DCF86345AD for ; Wed, 10 Mar 2010 03:26:03 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.208.211]) (amavisd-maia, port 10024) with ESMTP id 03676-04 for ; Wed, 10 Mar 2010 07:25:49 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from out-0.mx.aerioconnect.net (outw.internet-mail-service.net [216.240.47.246]) by mail.postgresql.org (Postfix) with ESMTP id 30FBD63406B for ; Wed, 10 Mar 2010 03:25:37 -0400 (AST) Received: from idiom.com (postfix@mx0.idiom.com [216.240.32.160]) by out-0.mx.aerioconnect.net (8.13.8/8.13.8) with ESMTP id o2A7PZk0020240 for ; Tue, 9 Mar 2010 23:25:35 -0800 X-Client-Authorized: MaGic Cook1e Received: from [192.168.2.104] (adsl-71-135-166-234.dsl.pltn13.pacbell.net [71.135.166.234]) by idiom.com (Postfix) with ESMTP id 278EA2D6012 for ; Tue, 9 Mar 2010 23:25:35 -0800 (PST) Message-ID: <4B974995.6070508@obviously.com> Date: Tue, 09 Mar 2010 23:26:13 -0800 From: Bryce Nesbitt User-Agent: Thunderbird 2.0.0.23 (Windows/20090812) MIME-Version: 1.0 To: pgsql-sql@postgresql.org Subject: Remote monitoring of Postgres w/minimal grants Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.67 on 216.240.47.51 X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-1.097 tagged_above=-10 required=5 tests=AWL=-0.357, BAYES_20=-0.74 X-Spam-Level: X-Archive-Number: 201003/53 X-Sequence-Number: 33760 I'm setting up remote monitoring of postgres, but running into an uncomfortable situation with permissions. Basically it seems hard to set up a secure "read only" role, yet also allow proper monitoring. A brief writeup of that is here: http://help.logicmonitor.com/installation-getting-started/notes-for-monitoring-specific-types-of-hosts/databases/postgresql/postgresql-credentials/ In order to get accurate server busy stats and max query time, the LogicMonitor user needs to be a superuser "alter role logicmonitor superuser;". Without the SuperUser privilege, all servers will appear busy, and maximum query time will always be 0. Is there a way to grant the type of permission needed to view stats, without superuser?