Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Untuk mengonfigurasi perilaku logging pgAudit, Anda menetapkan flag pgaudit.log
atau flag pgaudit.role:
Tetapkan pgaudit.log untuk mengaktifkan dan mengonfigurasi logging sesi. Anda dapat
menyetel flag ini pada instance, database, atau peran untuk menentukan cakupan
operasi yang dicatat oleh pgAudit. Anda menetapkan flag ke nilai yang menentukan jenis operasi yang dicatat oleh pgAudit.
Tetapkan pgaudit.role untuk mengaktifkan dan mengonfigurasi logging objek, yang mencatat pernyataan yang memengaruhi hubungan tertentu. Anda menetapkan tanda ini ke nama
peran, lalu memberikan akses pernyataan ke objek tertentu yang ingin
dicatat. Akses pernyataan mencakup SELECT, INSERT, UPDATE, and
DELETE. pgAudit mencatat semua operasi yang cocok dengan kombinasi
akses dan objek yang dijalankan oleh pengguna mana pun.
Bagian berikut memberikan contoh yang menunjukkan opsi untuk menyetel
perilaku logging pgAudit.
Mengonfigurasi logging audit sesi untuk database tertentu
Anda dapat mengonfigurasi pengauditan untuk database tertentu dengan menetapkan tanda pgaudit.log
di tingkat database.
Misalnya, untuk mengaktifkan pengauditan baca/tulis untuk database, finance:
finance=> ALTER DATABASE finance SET pgaudit.log = 'read,write';
Mengonfigurasi logging audit sesi untuk satu pengguna
Anda dapat mengaktifkan pengauditan untuk pengguna tertentu dengan menetapkan pgaudit.log
pada tingkat per peran.
Misalnya, untuk menetapkan pengauditan untuk semua operasi database yang dijalankan oleh pengguna,
Alice:
finance=> ALTER ROLE alice SET pgaudit.log = 'all';
Mengonfigurasi logging audit objek
Mengaudit suatu relasi lebih sempit daripada mengaudit basis data tertentu. Saat
Anda mengaudit sebuah relasi, sistem akan menetapkan peran auditor unik ke
parameter pgaudit.role. Operasi ini mencatat setiap objek atau relasi
yang diberikan ke peran ini.
Contoh:
Untuk mengonfigurasi audit untuk semua kueri SELECT pada relasi
salary dalam database karyawan:
employee=> CREATE ROLE auditor WITH NOLOGIN;employee=> ALTER DATABASE employee SET pgaudit.role = 'auditor';employee=> GRANT SELECT ON salary TO auditor;
Anda juga dapat mengaudit subset kolom untuk relasi tertentu.
Contoh:
Untuk mengonfigurasi logging audit yang hanya terjadi saat kolom income
dan tax_status diakses dari relasi gaji:
employee=> GRANT SELECT(income, tax_status) ON salary TO auditor;
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003e\u003ccode\u003epgaudit.log\u003c/code\u003e flag configures session logging, enabling you to audit operations at the instance, database, or role level by specifying the types of operations to log.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003epgaudit.role\u003c/code\u003e flag configures object logging, allowing you to log statements that affect specific relations by assigning a role and granting statement access to the desired objects.\u003c/p\u003e\n"],["\u003cp\u003eSession logging can be configured for all databases in an instance, a specific database, or a single user by setting the \u003ccode\u003epgaudit.log\u003c/code\u003e flag at the appropriate level.\u003c/p\u003e\n"],["\u003cp\u003eObject logging is set up by creating a custom auditor role, setting \u003ccode\u003epgaudit.role\u003c/code\u003e to the auditor role name, and then granting the role permissions on specific database relations and optionally, specific columns.\u003c/p\u003e\n"],["\u003cp\u003eOnly database users created via the Google Cloud console or \u003ccode\u003egcloud\u003c/code\u003e command can modify pgAudit settings, unlike users created with \u003ccode\u003eCREATE ROLE\u003c/code\u003e command.\u003c/p\u003e\n"]]],[],null,["# Configure logging behavior\n\nTo configure pgAudit logging behavior, you set the `pgaudit.log`\nflag or the `pgaudit.role` flag:\n\n- Set `pgaudit.log` to enable and configure session logging. You can\n set this flag on an instance, a database, or a role to define the scope of\n operations that the pgAudit logs. You set the flag to a value that defines\n the type of operations that the pgAudit logs.\n\n- Set `pgaudit.role` to enable and configure object logging, which\n logs statements that affect particular relations. You set this flag to the name\n of a role, and then grant statement access to specific objects that you want to\n be logged. The statement access includes `SELECT, INSERT, UPDATE, and\n DELETE`. pgAudit logs all operations that match the combination of\n access and object run by any user.\n\nThe following sections provide examples that show the options for setting\npgAudit logging behavior.\n| **Note:** Database users created through `CREATE ROLE` commands do not have the privilege to modify audit settings. Only database users created through the Google Cloud console and the gcloud command can modify audit settings.\n\nFor additional capabilities of the extension, review the\n[pgAudit documentation](https://github.com/pgaudit/pgaudit/blob/master/README.md/).\n\nConfigure session audit logging for all databases in an instance\n----------------------------------------------------------------\n\nTo configure auditing for all databases in an instance, set the\n`pgaudit.log` flag at the instance level.\n\nFor example:\n\n- To enable auditing for all operations on all databases in an instance: \n\n ```\n gcloud alloydb instances update my-instance \\\n --database-flags pgaudit.log=all[,flag2=value2...] \\\n --region=us-central1 \\\n --cluster=my-cluster \\\n --project=my-project\n ```\n- To enable auditing for only read and write operations on all databases in an instance: \n\n ```\n gcloud alloydb instances update my-instance \\\n --database-flags=^:^pgaudit.log=read,write[:flag2=value2...] \\\n --region=us-central1 \\\n --cluster=my-cluster \\\n --project=my-project\n ```\n\nNote the use of [alternate delimiter\nsyntax](/sdk/gcloud/reference/topic/escaping), which lets you use comma\ncharacters within a flag value.\n\nFor information about configuring database flags,\nsee [Configure database flags](/alloydb/docs/instance-configure-database-flags).\n\nConfigure session audit logging for a specific database\n-------------------------------------------------------\n\nYou can configure auditing for a specific database by setting the `pgaudit.log`\nflag at the database-level.\n\nFor example, to enable read/write auditing for a database, finance:\n\n`finance=\u003e ALTER DATABASE finance SET pgaudit.log = 'read,write';`\n\nConfigure session audit logging for a single user\n-------------------------------------------------\n\nYou can enable auditing for a specific user by setting the `pgaudit.log`\non a per role level.\n\nFor example, to set auditing for all database operations executed by the user,\nAlice:\n\n`finance=\u003e ALTER ROLE alice SET pgaudit.log = 'all';`\n\nConfigure object audit logging\n------------------------------\n\nAuditing for a relation is narrower than auditing for a specific database. When\nyou audit for a relation, the system assigns a unique auditor role to the\n`pgaudit.role` parameter. This operation logs any object or relation\nthat is granted to this role.\n\nFor example:\n\n- To configure auditing for all `SELECT` queries on the salary relation within the employee database: \n\n employee=\u003e CREATE ROLE auditor WITH NOLOGIN;\n employee=\u003e ALTER DATABASE employee SET pgaudit.role = 'auditor';\n employee=\u003e GRANT SELECT ON salary TO auditor;\n\nYou also can audit a subset of columns for a given relation.\n\nFor example:\n\n- To configure audit logging that occurs only when the `income` and `tax_status` columns are accessed from the salary relation: \n\n employee=\u003e GRANT SELECT(income, tax_status) ON salary TO auditor;"]]
