Re: [External] : Re: New feature request for adding session information to PostgreSQL transaction log

Hi Tom,

Our customers prefer "in product" solution instead of trigger-based solution due to the overheads and risks associated with triggers on their Production systems.

Oracle already provides the user session information in the redo/transaction logs.

We have created a feature request, and Microsoft is also implementing the feature to add session information to the SQL Server CDC tables.

We have a similar feature request for MySQL as well, to add session info to the MySQL binlog.

Since the session info is mandated by MCA ( Ministry of Corporate Affairs India) regulations, we would also request PostgreSQL to populate the user session info in the redo/transaction log of PostgreSQL DB.

Warm regards,
Sumanth Vishwaraj
________________________________
From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Sent: Sunday, January 19, 2025 10:32 PM
To: Sumanth Vishwaraj <sumanth(dot)vishwaraj(at)oracle(dot)com>
Cc: pgsql-hackers(at)lists(dot)postgresql(dot)org <pgsql-hackers(at)lists(dot)postgresql(dot)org>; Mahesh Rao <mahesh(dot)p(dot)rao(at)oracle(dot)com>; Nazia Zaidi <najiah(dot)abide(at)oracle(dot)com>; Jitesh Tiwari <jitesh(dot)tiwari(at)oracle(dot)com>; Nick Wagner <nick(dot)wagner(at)oracle(dot)com>; Scott Corbin <scott(dot)corbin(at)oracle(dot)com>; Mack Bell <mack(dot)bell(at)oracle(dot)com>; Avinash Dubey <avinash(dot)x(dot)dubey(at)oracle(dot)com>
Subject: [External] : Re: New feature request for adding session information to PostgreSQL transaction log

Sumanth Vishwaraj <sumanth(dot)vishwaraj(at)oracle(dot)com> writes:
> We would like PostgreSQL to store the details of who made the change (user/session) information in the transaction log.

You can build that yourself, typically by adding a trigger that stores
the value of "current_user" into inserted/updated rows. (If you want
to also track deletions, a separate audit log table would work
better.) The event-trigger feature might also be useful.

It's unlikely that we'd consider implementing such functionality at a
lower level, because these sorts of requirements always come with an
array of application-specific details about what is to be logged.
It would be impractical to satisfy all such cases in one implementation.
There would also be concerns about imposing overhead on users who
have no need for such a feature.

regards, tom lane