Thread: pgaudit log directory
Hello,
Can someone point me in the right direction?
I'm using PostgreSQL 10.5 on Linux (RHEL). I'm new to administering PostgreSQL and recently installed pgaudit. I believe I have it installed correctly and wanted to start playing with it to see how exactly it works.
So while walking through a tutorial I found online, I saw where I can enter a statement in PostgreSQL, such as:
ALTER SYSTEM SET pgaudit.log TO 'read, write';
SELECT pg_reload_conf();
Then after reading or writing to a table, you can then check "pg_log" for the audit entries. But my issue is that I can't find the log file at all?
In my main PostgreSQL directory (/work/PostgreSQL/10)I do have a file called "logfile", but there are no entries from today. When I go into the pgaudit sub-directory (/work/PostegreSQL/10/pgaudit) I don't see any log file in there either?
Can someone point me in the right direction?
Thanks,
Dave Hughes
Dave Hughes
On 18/11/19 9:56 μ.μ., Dave Hughes wrote: > Hello, > I'm using PostgreSQL 10.5 on Linux (RHEL). I'm new to administering PostgreSQL and recently installed pgaudit. I believeI have it installed correctly and wanted to start playing with it to see > how exactly it works. > > So while walking through a tutorial I found online, I saw where I can enter a statement in PostgreSQL, such as: > ALTER SYSTEM SET pgaudit.log TO 'read, write'; > SELECT pg_reload_conf(); > Then after reading or writing to a table, you can then check "pg_log" for the audit entries. But my issue is that I can'tfind the log file at all? > > In my main PostgreSQL directory (/work/PostgreSQL/10)I do have a file called "logfile", but there are no entries from today. When I go into the pgaudit sub-directory (/work/PostegreSQL/10/pgaudit) > I don't see any log file in there either? pgaudit writes in the standard pgsql log. > > Can someone point me in the right direction? > > Thanks, > Dave Hughes -- Achilleas Mantzios IT DEV Lead IT DEPT Dynacom Tankers Mgmt
Thanks for the response! I realized I didn't have the default logging turned on. I needed to edit the postgresql.conf file to enable log_destination = 'csvlog' and logging_collector = on. Once I did that I can now see the audit file.
On Tue, Nov 19, 2019 at 4:31 AM Achilleas Mantzios <achill@matrix.gatewaynet.com> wrote:
On 18/11/19 9:56 μ.μ., Dave Hughes wrote:
> Hello,
> I'm using PostgreSQL 10.5 on Linux (RHEL). I'm new to administering PostgreSQL and recently installed pgaudit. I believe I have it installed correctly and wanted to start playing with it to see
> how exactly it works.
>
> So while walking through a tutorial I found online, I saw where I can enter a statement in PostgreSQL, such as:
> ALTER SYSTEM SET pgaudit.log TO 'read, write';
> SELECT pg_reload_conf();
> Then after reading or writing to a table, you can then check "pg_log" for the audit entries. But my issue is that I can't find the log file at all?
>
> In my main PostgreSQL directory (/work/PostgreSQL/10)I do have a file called "logfile", but there are no entries from today. When I go into the pgaudit sub-directory (/work/PostegreSQL/10/pgaudit)
> I don't see any log file in there either?
pgaudit writes in the standard pgsql log.
>
> Can someone point me in the right direction?
>
> Thanks,
> Dave Hughes
--
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt