Thanks for the tips Joe! After fighting with this all day, I realized while I was testing this, I was logging into the database as the "postgres" user. For some reason those actions were not being logged. But once I logged in as another superuser account I have, I saw all my ddl statements being audited in the log file. So it was working after all, but just not for the "postgres" user. Do you happen to know if that behavior is how pgaudit is supposed to work? You'd think even the "postgres" user activity would be logged as well?
Thanks again.
On Wed, Nov 20, 2019 at 9:46 AM Joe Conway <mail@xxxxxxxxxxxxx> wrote:
On 11/20/19 8:09 AM, Dave Hughes wrote:
> Hey,
> Thanks for reaching out. It looks like I have that parameter set as
> well. Here is a list of settings I have turned on in postgresql.conf
> since I installed pgAudit:
>
> shared_preload_libraries = 'pgaudit'
> log_destination = 'csvlog'
> logging_collector = on
> log_directory = '/work/PostgreSQL/10/data'
> log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
> log_connections = on
> log_disconnections = on
> log_line_prefix = '<%m:%r:%u@%d:[%p]:>'
> pgaudit.log = 'ddl'
>
> Is there some other setting I may be missing?
I don't see anything wrong that jumps out except perhaps the OS postgres
user does not have sufficient permissions to write to
'/work/PostgreSQL/10/data'.
Beyond that, please see the supplemental PDF here for an example setup
instruction (section 2.2/appendix B, and possibly section 2.3 as well):
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_PostgreSQL_9-x_V1R6_STIG.zip
Also read through the pgaudit README if you have not already done so:
https://github.com/pgaudit/pgaudit
Finally (again if not already done), see the docs section on logging:
https://www.postgresql.org/docs/12/runtime-config-logging.html
HTH,
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
