Re: pgaudit - an auditing extension for PostgreSQL - Mailing list pgsql-hackers

From Stephen Frost
Subject Re: pgaudit - an auditing extension for PostgreSQL
Date
Msg-id 20140625041055.GM16098@tamriel.snowman.net
Whole thread Raw
In response to Re: pgaudit - an auditing extension for PostgreSQL  (Abhijit Menon-Sen <ams@2ndquadrant.com>)
Responses Re: pgaudit - an auditing extension for PostgreSQL  (Alvaro Herrera <alvherre@2ndquadrant.com>)
Re: pgaudit - an auditing extension for PostgreSQL  (Abhijit Menon-Sen <ams@2ndquadrant.com>)
List pgsql-hackers
Abhijit,

* Abhijit Menon-Sen (ams@2ndquadrant.com) wrote:
> At 2014-06-24 14:02:11 -0400, sfrost@snowman.net wrote:
> >
> > Will you (collectively) be working in this direction for 9.5?
>
> We have some time available to work on it, but not so much that I want
> to write any more code without a clearer idea of what might be accepted
> eventually for inclusion.

You and me both... (see nearby discussion regarding the redesign of
RLS..).  For my part, the nexts steps might be to consider how you'd
migrate what you've provided for configuration into catalog tables and
how we'd address the concerns raised elsewhere regarding catalog access
in cases where we're not in a transaction (or at least addressing those
areas and working out what the logging would do in those situations..).

We'd also end up re-working the code to be called as part of PG core
rather than through hook functions, of course, but I don't think those
changes would be too bad compared to figuring out the other issues.

Additionally, thought towards what the SQL-level syntax would be is
another key point- would the main command be 'ALTER AUDIT'?  What would
the sub-commands of that look like for the DBA/auditor who is tasked
with defining/implementing the auditing for the system?  How would we
include data in a structured, yet flexible way?  (That is to say, the
set of tables and columsn logged could be varied, yet we'd want to see
the actual data logged- perhaps as JSON?).

Looking forward to your thoughts.
Thanks!
    Stephen

pgsql-hackers by date:

Previous
From: Abhijit Menon-Sen
Date:
Subject: Re: pgaudit - an auditing extension for PostgreSQL
Next
From: Amit Langote
Date:
Subject: makeAndExpr(), etc. confined to gram.y?