Re: Single Line Query Logging

Hi Emre,

Am 10.07.2013 12:16, schrieb Emre ÖZTÜRK:
> Hello all,
>
> Is there a parameter to log any SQL query as a single line in audit
> logs? I have some problems in my SIEM application. If a DBA sends the
> query as a single line I can gather the whole query, but if he enters like
>
> UPDATE x .......
> y=Z ......
> where ......
>
> I only get the line starts with UPDATE then I can not see what is really
> changed in my SIEM logs. I have heard that there is a parameter do what
> I mean. Do you agree?

Do you log to syslog?

I had a look into src/backend/utils/error/elog.c and found the following
comment:

/*
* our problem here is that many syslog implementations don't handle long
* messages in an acceptable manner. while this function doesn't help that
* fact, it does work around by splitting up messages into smaller pieces.
*
* we divide into multiple syslog() calls if message is too long or if the
* message contains embedded newline(s).
*/

If you use a dedicated logfile for PostgreSQL these commands will not be
split.

Example:

Statement:
test=# select * from
test;

PostgreSQL logfile:
LOG: statement: select * from
test;

syslog:
Jul 10 21:13:17 db1 postgres[32714]: [3-1] LOG: statement: select * from
Jul 10 21:13:17 db1 postgres[32714]: [3-2] #011test;

I hope it helps.

>
> Regards,
>
>
>
> /*Emre ÖZTÜRK*/

Regards

- Adrian