To read the logs, it is sufficient to use the group under which the DBMS instance is running. To do this, the group needs to be granted read access to log files, and then the user under which the collector is running should be added to the same group. Typically, this is the postgres group.

Additionally, it is necessary to adjust the DBMS instance configuration so that new log files are created with the required access permissions. This is achieved by modifying the log_file_mode parameter and reloading the configuration. The parameter can be updated either directly in the configuration file, via ALTER SYSTEM, or through automation tools and IaC (Infrastructure as Code) solutions.

In the example below, the change is made by connecting to the DBMS instance and using ALTER SYSTEM:

psql -U postgres -c 'ALTER SYSTEM SET log_file_mode TO "0640"'
psql -U postgres -c 'SELECT pg_reload_conf()'

Set a password when creating a user:

sudo -u postgres createuser --pwprompt otelcol

To set up permissions, connect to the DBMS instance and run the following commands:

GRANT pg_monitor TO otelcol;

When using plugins that require connections to other databases (such as collecting tables, indexes, or bloat), the HBA (Host-Based Authentication) rules must be aligned with the collector rules:

PostgreSQL DBMS supports a wide variety of authentication methods. When setting up HBA rules, focus on the method that is used in your case.

The example below shows how to set up access to the database postgres using the scram-sha-256 method.

vi pg_hba.conf

local  postgres  otelcol                 scram-sha-256
host   postgres  otelcol  127.0.0.1/32   scram-sha-256

In this example, the connection capability is limited to only the postgres database; if the collector is configured to collect data from other databases, the corresponding allowing rules must be added to the HBA configuration.

Reload the DBMS instance configuration for the changes to take effect:

sudo -u postgres psql -c 'SELECT pg_reload_conf()'

Different types of collected data require access to various internal functions. Access to these functions is restricted for general users, as they can reveal confidential information. Therefore, granting access should be coordinated with the company's security policies.

See Section 1.3.1 for information about the access privileges required for seamless operation.

The connection parameters for the DBMS instance are managed in the postgrespro receiver configuration of the collector configuration file. The user credentials should be specified in the endpoint, database, username, and password parameters (it is possible to pass the password through an environment variable):

receivers:
postgrespro:
  transport: tcp
  endpoint: localhost:5432
  database: postgres
  username: otelcol
  password: ${env:POSTGRESQL_PASSWORD}

pgpro-otel-collector supports regular expressions in ACL (Access Control List) configuration for both allowlists and denylists. Regular expressions eliminate the need to manually update ACL configurations when new database objects are created. Instead of listing individual objects, you can define patterns that automatically include or exclude objects based on their names. An example of such a regular expression is shown below.

receivers:
  postgrespro:
    transport: tcp
    endpoint: &endpoint localhost:5432
    database: postgres
    username: postgres
    password: ${env:POSTGRESQL_PASSWORD}
    collection_interval: 60s
    initial_delay: 1s
    max_threads: 3
    plugins:
      databases:
        allow:
          - name: db1.*
            schemas:
              - name: sch1.*
                tables:
                  - name: tb1.*
                  - name: tb2.*
                    indexes:
                    - name: idx2.*
      activity:
        enabled: true
      tables:
        enabled: true
      indexes:
        enabled: true
        # Allowlists can be set up for a specific plugin
        # databases:
        #   - name: db1.*
        #     schemas:
        #       - name: sch1.*
        #         tables:
        #           - name: tb1.*
        #           - name: tb2.*
        #             indexes:
        #             - name: idx2.*
      functions:
        enabled: true
      bloat_tables:
        enabled: true
      bloat_indexes:
        enabled: true