| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | Nikolay Samokhvalov <samokhvalov(at)gmail(dot)com> |
| Cc: | Holger Jakobs <holger(at)jakobs(dot)com>, Daulat <daulat(dot)dba(at)gmail(dot)com>, pgsql-admin <pgsql-admin(at)lists(dot)postgresql(dot)org> |
| Subject: | Re: How to Log DBA actions |
| Date: | 2021-12-21 21:31:22 |
| Message-ID: | 161736.1640122282@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-admin |
Nikolay Samokhvalov <samokhvalov(at)gmail(dot)com> writes:
> On Sun, Dec 19, 2021 at 10:43 PM Holger Jakobs <holger(at)jakobs(dot)com> wrote:
>> There is a setting log_statements which can be set to none (the default),
>> ddl, mod or all
> ..and, unfortunately, any user will be able to set it back via SET.
Really?
regression=# create user joe;
CREATE ROLE
regression=# \c - joe
You are now connected to database "regression" as user "joe".
regression=> set log_statement = none;
ERROR: permission denied to set parameter "log_statement"
It is true that superusers can change that variable. However, if
you are trying to force monitoring of an uncooperative superuser,
you are in for a hard slog.
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Nikolay Samokhvalov | 2021-12-21 21:49:04 | Re: How to Log DBA actions |
| Previous Message | Achilleas Mantzios | 2021-12-21 21:28:44 | Re: Reconfiguring active PostgreSQL instance |