Auditing database access

Auditing database access is a much bigger topic than you might expect because it can cover a whole range of requirements.

Getting ready

First, decide which of these you want and look at the appropriate subsection:

• What were the SQL statements executed? Auditing SQL
• What were the tables accessed? Auditing table access
• What were the data rows changed? Auditing data changes
• What were the data rows viewed? Not described here, usually too much data

Auditing just SQL produces the lowest volume of audit log information, especially if you choose to log only DDL. Higher levels accumulate more information very rapidly, so you may quickly decide not to do this in practice. Read each section to understand the benefits and trade-offs.

Auditing SQL

There are two main ways to log SQL:

• Using the PostgreSQL log_statement parameter
• Using the pgaudit extension's pgaudit.log parameter

The log_statement parameter can be set to one of the following options:

• ALL: Logs all SQL statements executed at...