pg.ddx.io  pgsql-sql@postgresql.org mailing list archive  

help / color / mirror / Atom feed

Remote monitoring of Postgres w/minimal grants
2+ messages / 2 participants
[nested] [flat]

* Remote monitoring of Postgres w/minimal grants
@ 2010-03-10 07:26  Bryce Nesbitt <bryce2@obviously.com>
  0 siblings, 1 reply; 2+ messages in thread

From: Bryce Nesbitt @ 2010-03-10 07:26 UTC (permalink / raw)
  To: pgsql-sql

I'm setting up remote monitoring of postgres, but running into an 
uncomfortable situation with permissions.
Basically it seems hard to set up a secure "read only" role, yet also 
allow proper monitoring.

A brief writeup of that is here:
http://help.logicmonitor.com/installation-getting-started/notes-for-monitoring-specific-types-of-hos...
In order to get accurate server busy stats and max query time, the 
LogicMonitor user needs to be a superuser "alter role logicmonitor 
superuser;". Without the SuperUser privilege, all servers will appear 
busy, and maximum query time will always be 0.

Is there a way to grant the type of permission needed to view stats, 
without superuser?




^ permalink  raw  reply  [nested|flat] 2+ messages in thread

* Re: Remote monitoring of Postgres w/minimal grants
@ 2010-03-11 22:20  Tony Wasson <ajwasson@gmail.com>
  parent: Bryce Nesbitt <bryce2@obviously.com>
  0 siblings, 0 replies; 2+ messages in thread

From: Tony Wasson @ 2010-03-11 22:20 UTC (permalink / raw)
  To: Bryce Nesbitt <bryce2@obviously.com>; +Cc: pgsql-sql

On Wed, Mar 10, 2010 at 12:26 AM, Bryce Nesbitt <bryce2@obviously.com>wrote:

> I'm setting up remote monitoring of postgres, but running into an
> uncomfortable situation with permissions.
> Basically it seems hard to set up a secure "read only" role, yet also allow
> proper monitoring.
>
> A brief writeup of that is here:
>
> http://help.logicmonitor.com/installation-getting-started/notes-for-monitoring-specific-types-of-hos...
> In order to get accurate server busy stats and max query time, the
> LogicMonitor user needs to be a superuser "alter role logicmonitor
> superuser;". Without the SuperUser privilege, all servers will appear busy,
> and maximum query time will always be 0.
>
> Is there a way to grant the type of permission needed to view stats,
> without superuser?
>

Seems like you could get around most of these cases by making a function or
set returning function to return the data and making it "security definer"
and then grant your monitoring user access to that.

Tony

^ permalink  raw  reply  [nested|flat] 2+ messages in thread

end of thread, other threads:[~2010-03-11 22:20 UTC | newest]

Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2010-03-10 07:26 Remote monitoring of Postgres w/minimal grants Bryce Nesbitt <bryce2@obviously.com>
2010-03-11 22:20 ` Tony Wasson <ajwasson@gmail.com>

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox