From: Tony Wasson <ajwasson@gmail.com>
To: Bryce Nesbitt <bryce2@obviously.com>
Cc: pgsql-sql@postgresql.org
Subject: Re: Remote monitoring of Postgres w/minimal grants
Date: Thu, 11 Mar 2010 15:20:54 -0700
Message-ID: <6d8daee31003111420t6c658c9i593301f33725565a@mail.gmail.com> (raw)
In-Reply-To: <4B974995.6070508@obviously.com>
References: <4B974995.6070508@obviously.com>
On Wed, Mar 10, 2010 at 12:26 AM, Bryce Nesbitt <bryce2@obviously.com>wrote:
> I'm setting up remote monitoring of postgres, but running into an
> uncomfortable situation with permissions.
> Basically it seems hard to set up a secure "read only" role, yet also allow
> proper monitoring.
>
> A brief writeup of that is here:
>
> http://help.logicmonitor.com/installation-getting-started/notes-for-monitoring-specific-types-of-hos...
> In order to get accurate server busy stats and max query time, the
> LogicMonitor user needs to be a superuser "alter role logicmonitor
> superuser;". Without the SuperUser privilege, all servers will appear busy,
> and maximum query time will always be 0.
>
> Is there a way to grant the type of permission needed to view stats,
> without superuser?
>
Seems like you could get around most of these cases by making a function or
set returning function to return the data and making it "security definer"
and then grant your monitoring user access to that.
Tony
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: ajwasson@gmail.com, bryce2@obviously.com
Subject: Re: Remote monitoring of Postgres w/minimal grants
In-Reply-To: <6d8daee31003111420t6c658c9i593301f33725565a@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox