May 2018
Intermediate to advanced
576 pages
30h 25m
English
pgaudit can log each access to each table. So if an SQL table touches three tables then it can generate three log records, one for each table. This is important because otherwise, you might have to try and parse the SQL to find out which tables it touched, which would be difficult without access to the schema and the search_path settings.
To make it easier to access the audit log per table, adjust these settings:
pgaudit.log_relation = onpgaudit.log_statement_once = off
If you want even finer grained auditing, pgaudit allows you to control which tables are audited. The user cannot tell which tables are logged and which are not, so it is possible for investigators to quietly enhance the level of logging once they are ...