Thread: log_statement = 'mod' does not log all data modifying statements

log_statement = 'mod' does not log all data modifying statements

From
Jack Christensen
Date:
I was recently surprised by changes that were not logged by
log_statement = 'mod'. After changing log_statement to 'all', I found
that the changes were occurring in a writable CTE.

Is there a way to log all statements that update data?

Jack



Re: log_statement = 'mod' does not log all data modifying statements

From
Bruce Momjian
Date:
On Fri, Jun 12, 2015 at 01:54:30PM -0500, Jack Christensen wrote:
> I was recently surprised by changes that were not logged by
> log_statement = 'mod'. After changing log_statement to 'all', I
> found that the changes were occurring in a writable CTE.
>
> Is there a way to log all statements that update data?

Not really.  Is this something we should document better?

--
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + Everyone has their own god. +


Re: log_statement = 'mod' does not log all data modifying statements

From
Stephen Frost
Date:
* Bruce Momjian (bruce@momjian.us) wrote:
> On Fri, Jun 12, 2015 at 01:54:30PM -0500, Jack Christensen wrote:
> > I was recently surprised by changes that were not logged by
> > log_statement = 'mod'. After changing log_statement to 'all', I
> > found that the changes were occurring in a writable CTE.
> >
> > Is there a way to log all statements that update data?
>
> Not really.  Is this something we should document better?

pg_audit handles this (it is one of the specific goals of that project,
in fact) and the case where modifications are done inside of DO blocks
and PL code.  Further, it provides a great deal of additional
flexibility.

What we need here is better logging/auditing capabilities in core.
Improving the documentation for the back-branches is good but doesn't
address this use-case.  It's unfortunate that we don't have a better
answer at this time.

Thanks!

Stephen

Attachment

Re: log_statement = 'mod' does not log all data modifying statements

From
Igor Neyman
Date:

-----Original Message-----
From: pgsql-general-owner@postgresql.org [mailto:pgsql-general-owner@postgresql.org] On Behalf Of Stephen Frost
Sent: Wednesday, September 09, 2015 10:17 AM
To: Bruce Momjian <bruce@momjian.us>
Cc: Jack Christensen <jack@jackchristensen.com>; pgsql-general@postgresql.org
Subject: Re: [GENERAL] log_statement = 'mod' does not log all data modifying statements

* Bruce Momjian (bruce@momjian.us) wrote:
> On Fri, Jun 12, 2015 at 01:54:30PM -0500, Jack Christensen wrote:
> > I was recently surprised by changes that were not logged by
> > log_statement = 'mod'. After changing log_statement to 'all', I
> > found that the changes were occurring in a writable CTE.
> >
> > Is there a way to log all statements that update data?
>
> Not really.  Is this something we should document better?

pg_audit handles this (it is one of the specific goals of that project, in fact) and the case where modifications are
doneinside of DO blocks and PL code.  Further, it provides a great deal of additional flexibility. 

What we need here is better logging/auditing capabilities in core.
Improving the documentation for the back-branches is good but doesn't address this use-case.  It's unfortunate that we
don'thave a better answer at this time. 

Thanks!

Stephen

_______________________

Could you please provide reference to pg_audit?

TIA,
Igor Neyman



Re: log_statement = 'mod' does not log all data modifying statements

From
Michael Paquier
Date:
On Wed, Sep 9, 2015 at 11:24 PM, Igor Neyman wrote:
> Could you please provide reference to pg_audit?

Should be here:
http://pgaudit.org/
https://github.com/pgaudit/pgaudit
--
Michael