F.30. pgAudit Log to File#
F.30. pgAudit Log to File #
F.30.2. Description #
pgAudit Log to File is an
addon to pgAudit that will redirect audit log
lines to an independent file, instead of using the PostgreSQL server logger.
This will allow us to have an audit file that we can easily rotate without polluting server logs with those messages.
Audit logs in heavily used systems can grow very fast. This extension allows automatic rotation of the files based on a set number of minutes.
F.30.3. Installation #
Add
pgauditlogtofileto "shared_preload_libraries" inpostgresql.confRestart PostgreSQL to reload the new shared library
Create the extension in the postgres database (like pgaudit, there's no need to create it in all the databases)
postgres=# CREATE EXTENSION pgauditlogtofile;
F.30.4. Configuration #
F.30.4.1. pgaudit.log_directory #
Name of the directory where the audit file will be created.
Scope: System
Default: 'log'
Empty or NULL will disable the extension and the audit logging will be done to the PostgreSQL server logger.
F.30.4.2. pgaudit.log_filename #
Name of the file where the audit will be written. Writing to an existing file will append the new entries. This variable can contain time patterns up to the minute to allow automatic rotation.
Scope: System
Default: 'audit-%Y%m%d_%H%M.log'
Empty or NULL will disable the extension and the audit logging will be done to the PostgreSQL server logger.
F.30.4.3. pgaudit.log_rotation_age #
Number of minutes after which the audit file will be rotated.
Scope: System
Default: 1440 minutes (1 day)
Performance Notes:
If
log_rotation_age < 60the rotation background worker will wake up every 10 seconds.If
log_rotation_age > 60the rotation background worker will wake up every 1 minute.
F.30.4.4. pgaudit.log_rotation_size #
This parameter determines the maximum size of an individual log file. Turns on only when the parameter is explicitly specified and adds microseconds to the current timestamp.
Scope: System
Default: 0
F.30.4.5. pgaudit.log_connections #
Intercepts server log messages emitted when log_connections is on.
Scope: System
Default: off
Requires: log_connections = on
F.30.4.6. pgaudit.log_disconnections #
Intercepts server log messages emitted when log_disconnections is on.
Scope: System
Default: off
Requires: log_disconnections = on
F.30.4.7. pgaudit.log_autoclose_minutes #
EXPERIMENTAL:: automatically closes the audit log file handler kept by a backend after N minutes of inactivity.
This features creates a background thread that will sleep in the background and close the file handler.
Scope: System
Default: 0
F.30.4.8. pgAudit Log To File - Record format #
Supports only 'csv' log format.
CREATE FOREIGN TABLE pgauditlogtofile_extern ( ----fields from postgresql session---- log_time timestamptz(3) NULL, user_name text NULL, database_name text NULL, process_id int4 NULL, remote_client text NULL, remote_port text NULL, session_id text NULL, session_line_num int8 NULL, command_tag text NULL, session_start_time timestamptz NULL, virtual_transaction_id text NULL, transaction_id int8 NULL, sql_state_code text NULL, -----fields from pgaudit record------- audit_type text NULL, statement_id text NULL, substatement_id text NULL, "class" text NULL, command text NULL, object_type text NULL, object_name text NULL, "statement" text NULL, "parameter" text NULL, ----additional fields-------- detail text NULL, hint text NULL, internal_query text NULL, internal_query_pos int4 NULL, context text NULL, debug_query text NULL, cursor_pos int4 NULL, function_name text NULL, filename_linenum text NULL, application_name text NULL ) SERVER your_server OPTIONS (filename 'audit_log.csv', format 'csv');
F.30.4.9. Test #
cd test vagrant plugin install vagrant-vbguest vagrant up