Received: from maia.hub.org (maia-5.hub.org [200.46.204.29])
	by mail.postgresql.org (Postfix) with ESMTP id C35F1B5DBEE
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Tue, 16 Aug 2011 18:03:14 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.29]) (amavisd-maia, port 10024)
	with ESMTP id 96109-01; Tue, 16 Aug 2011 21:03:08 +0000 (UTC)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from dime159.dizinc.com (dime159.dizinc.com [66.7.216.77])
	by mail.postgresql.org (Postfix) with ESMTP id E123AB5DBE1;
	Tue, 16 Aug 2011 18:03:07 -0300 (ADT)
Received: from [200.32.232.82] (port=55265 helo=[10.20.30.55])
	by dime159.dizinc.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69)
	(envelope-from <lists@turnkey.bz>)
	id 1QtQmp-0005Y3-Kv; Tue, 16 Aug 2011 17:02:59 -0400
Message-ID: <4E4ADB02.4020808@turnkey.bz>
Date: Tue, 16 Aug 2011 15:02:58 -0600
From: "M. D." <lists@turnkey.bz>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US;
	rv:1.9.2.18) Gecko/20110617 Lightning/1.0b2 Thunderbird/3.1.11
MIME-Version: 1.0
To: pgsql-sql@postgresql.org, pgsql-admin@postgresql.org
Subject: parsing audit table
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse,
	please include it with any abuse report
X-AntiAbuse: Primary Hostname - dime159.dizinc.com
X-AntiAbuse: Original Domain - postgresql.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - turnkey.bz
X-Source: 
X-Source-Args: 
X-Source-Dir: 
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-1.9 tagged_above=-10 required=5 tests=BAYES_00=-1.9
X-Spam-Level: 
X-Archive-Number: 201108/152
X-Sequence-Number: 38139

Hi everyone,

I'm a bit lazy, or actually in a bit of a crunch.  I added an audit 
recording a few months ago, but never really used it much, but today I'm 
seeing a bunch of suspicious activity by one user.  Does someone have 
any function to quickly parse this data?

I followed this: http://wiki.postgresql.org/wiki/Audit_trigger - so I'm 
hoping someone else has something to parse that.

original data: 
"(B04TaEsAAIG5bEEX5xBVPQ,2,jakew,mag,"",2011-07-05,2011-07-05,,,7,528284,"",2011-07-05,13:20:59,2011-07-05,"",A04CQUUABSxYfxftPQqJlg,,JUfhSzwADKqAFSN1Cbv+mg,BUiZqlIABburW7jqdY9JJQ,HUZPx0gACfCxy1Y34QSTQw,,,0,N,Y,Y,919.9100,0.0000,0.0000,2011-07-05,2011-07-05)"
new data:
"(B04TaEsAAIG5bEEX5xBVPQ,3,jakew,mag,"",2011-07-05,2011-07-05,,,7,528284,"",2011-07-05,13:20:59,2011-07-05,"",A04CQUUABSxYfxftPQqJlg,,JUfhSzwADKqAFSN1Cbv+mg,BUiZqlIABburW7jqdY9JJQ,HUZPx0gACfCxy1Y34QSTQw,,,0,N,N,Y,919.9100,919.9100,0.0000,,2011-08-04)"

those 22 alphanumeric columns are IDs.

Thanks for any help,
Mark