Hi Emre,
Am 10.07.2013 12:16, schrieb Emre ÖZTÜRK:
> Hello all,
>
> Is there a parameter to log any SQL query as a single line in audit
> logs? I have some problems in my SIEM application. If a DBA sends the
> query as a single line I can gather the whole query, but if he enters like
>
> UPDATE x .......
> y=Z ......
> where ......
>
> I only get the line starts with UPDATE then I can not see what is really
> changed in my SIEM logs. I have heard that there is a parameter do what
> I mean. Do you agree?
Do you log to syslog?
I had a look into src/backend/utils/error/elog.c and found the following
comment:
/*
* our problem here is that many syslog implementations don't handle long
* messages in an acceptable manner. while this function doesn't help that
* fact, it does work around by splitting up messages into smaller pieces.
*
* we divide into multiple syslog() calls if message is too long or if the
* message contains embedded newline(s).
*/
If you use a dedicated logfile for PostgreSQL these commands will not be
split.
Example:
Statement:
test=# select * from
test;
PostgreSQL logfile:
LOG: statement: select * from
test;
syslog:
Jul 10 21:13:17 db1 postgres[32714]: [3-1] LOG: statement: select * from
Jul 10 21:13:17 db1 postgres[32714]: [3-2] #011test;
I hope it helps.
>
> Regards,
>
>
>
> /*Emre ÖZTÜRK*/
Regards
- Adrian
