Re: Enable DB level audit trail

[Ron Johnson <ronljohnsonjr@xxxxxxxxx>]

"Audit tables" are tables just like any other table, which means they can be changed by anyone with a superuser ROLE.

pgaudit and Qradar rsyslog is how you unalterably track table changes.  That, of course, means you need the Qradar software on another server, etc, etc, etc.

But if lawyers and security compliance officers don't care... then sure, triggers and "audit tables" work just fine.  I recommend adding a timestamp and "action code" ('I'=insert, 'U'=update, 'D'=delete) to the audit tables in addition to cloning the base table's columns.

On Tue, Apr 16, 2024 at 1:32 PM Siraj G <tosiraj.g@xxxxxxxxx> wrote:

Thank you Ron.

Would it be good to use trigger based auditing or via pgAudit?

All we want is to capture changes in a few tables.

Regards

Siraj

On Mon, Apr 8, 2024 at 6:24 PM Ron Johnson <ronljohnsonjr@xxxxxxxxx> wrote:

Lots of extra stuff in the postgresql log files.

On Mon, Apr 8, 2024 at 3:56 AM Siraj G <tosiraj.g@xxxxxxxxx> wrote:

Also, I would like to understand the implications of enabling the DB audit.

Appreciate the help.

Regards

Siraj

On Mon, Apr 8, 2024 at 11:30 AM Siraj G <tosiraj.g@xxxxxxxxx> wrote:

Hello Admins!

How do we enable DB level audit trail in PgSQL?

Regards

Siraj