Message-ID: <4E4AE5BB.309@turnkey.bz>
Date: Tue, 16 Aug 2011 15:48:43 -0600
From: "M. D." <lists@turnkey.bz>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US;
	rv:1.9.2.18) Gecko/20110617 Lightning/1.0b2 Thunderbird/3.1.11
MIME-Version: 1.0
To: pgsql-admin@postgresql.org
Subject: Re: parsing audit table
References: <4E4ADB02.4020808@turnkey.bz>
	<8555352967C94741A7ECD57251DA0F26C46BF7908E@EX07.TIGR.ORG>
In-Reply-To: <8555352967C94741A7ECD57251DA0F26C46BF7908E@EX07.TIGR.ORG>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Yes, that does work (and I've been doing just that), but I was hoping 
for some database function (in python preferably) that I could return a 
row with it's columns and then query corresponding data to make more 
sense out of it.
I see it as a complicated function, but if someone would have a similar 
function, it would make it 10x easier to make sense of the audit table.  
I think it could be made to query corresponding data from any table.


On 08/16/2011 03:08 PM, Hoover, Jeffrey wrote:
> If you reformat it like:
>
> 	original,B04TaEsAAIG5bEEX5xBVPQ,2,jakew,mag,...,2011-07-05
> 	new, B04TaEsAAIG5bEEX5xBVPQ,3,jakew,mag,...,2011-08-04
>
> you could probably load it into excel
>
>
>
> -----Original Message-----
> From: pgsql-admin-owner@postgresql.org [mailto:pgsql-admin-owner@postgresql.org] On Behalf Of M. D.
> Sent: Tuesday, August 16, 2011 5:03 PM
> To: pgsql-sql@postgresql.org; pgsql-admin@postgresql.org
> Subject: [ADMIN] parsing audit table
>
> Hi everyone,
>
> I'm a bit lazy, or actually in a bit of a crunch.  I added an audit
> recording a few months ago, but never really used it much, but today I'm
> seeing a bunch of suspicious activity by one user.  Does someone have
> any function to quickly parse this data?
>
> I followed this: http://wiki.postgresql.org/wiki/Audit_trigger - so I'm
> hoping someone else has something to parse that.
>
> original data:
> "(B04TaEsAAIG5bEEX5xBVPQ,2,jakew,mag,"",2011-07-05,2011-07-05,,,7,528284,"",2011-07-05,13:20:59,2011-07-05,"",A04CQUUABSxYfxftPQqJlg,,JUfhSzwADKqAFSN1Cbv+mg,BUiZqlIABburW7jqdY9JJQ,HUZPx0gACfCxy1Y34QSTQw,,,0,N,Y,Y,919.9100,0.0000,0.0000,2011-07-05,2011-07-05)"
> new data:
> "(B04TaEsAAIG5bEEX5xBVPQ,3,jakew,mag,"",2011-07-05,2011-07-05,,,7,528284,"",2011-07-05,13:20:59,2011-07-05,"",A04CQUUABSxYfxftPQqJlg,,JUfhSzwADKqAFSN1Cbv+mg,BUiZqlIABburW7jqdY9JJQ,HUZPx0gACfCxy1Y34QSTQw,,,0,N,N,Y,919.9100,919.9100,0.0000,,2011-08-04)"
>
> those 22 alphanumeric columns are IDs.
>
> Thanks for any help,
> Mark
>