pgaudit log directory

Started by Dave Hughesover 6 years ago3 messagesgeneral
Jump to latest
#1Dave Hughes
dhughes20@gmail.com

Hello,
I'm using PostgreSQL 10.5 on Linux (RHEL). I'm new to administering
PostgreSQL and recently installed pgaudit. I believe I have it installed
correctly and wanted to start playing with it to see how exactly it works.

So while walking through a tutorial I found online, I saw where I can enter
a statement in PostgreSQL, such as:
ALTER SYSTEM SET pgaudit.log TO 'read, write';
SELECT pg_reload_conf();
Then after reading or writing to a table, you can then check "pg_log" for
the audit entries. But my issue is that I can't find the log file at all?

In my main PostgreSQL directory (/work/PostgreSQL/10)I do have a file
called "logfile", but there are no entries from today. When I go into the
pgaudit sub-directory (/work/PostegreSQL/10/pgaudit) I don't see any log
file in there either?

Can someone point me in the right direction?

Thanks,
Dave Hughes

#2Achilleas Mantzios
achill@matrix.gatewaynet.com
In reply to: Dave Hughes (#1)
Re: pgaudit log directory

On 18/11/19 9:56 μ.μ., Dave Hughes wrote:

Hello,
I'm using PostgreSQL 10.5 on Linux (RHEL).  I'm new to administering PostgreSQL and recently installed pgaudit.  I believe I have it installed correctly and wanted to start playing with it to see
how exactly it works.

So while walking through a tutorial I found online, I saw where I can enter a statement in PostgreSQL, such as:
ALTER SYSTEM SET pgaudit.log TO 'read, write';
SELECT pg_reload_conf();
Then after reading or writing to a table, you can then check "pg_log" for the audit entries.  But my issue is that I can't find the log file at all?

In my main PostgreSQL directory (/work/PostgreSQL/10)I do have a file called "logfile", but there are no entries from today.  When I go into the pgaudit sub-directory (/work/PostegreSQL/10/pgaudit)
I don't see any log file in there either?

pgaudit writes in the standard pgsql log.

Can someone point me in the right direction?

Thanks,
Dave Hughes

--
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt

#3Dave Hughes
dhughes20@gmail.com
In reply to: Achilleas Mantzios (#2)
Re: pgaudit log directory

Thanks for the response! I realized I didn't have the default logging
turned on. I needed to edit the postgresql.conf file to enable
log_destination = 'csvlog' and logging_collector = on. Once I did that I
can now see the audit file.

On Tue, Nov 19, 2019 at 4:31 AM Achilleas Mantzios <
achill@matrix.gatewaynet.com> wrote:

Show quoted text

On 18/11/19 9:56 μ.μ., Dave Hughes wrote:

Hello,
I'm using PostgreSQL 10.5 on Linux (RHEL). I'm new to administering

PostgreSQL and recently installed pgaudit. I believe I have it installed
correctly and wanted to start playing with it to see

how exactly it works.

So while walking through a tutorial I found online, I saw where I can

enter a statement in PostgreSQL, such as:

ALTER SYSTEM SET pgaudit.log TO 'read, write';
SELECT pg_reload_conf();
Then after reading or writing to a table, you can then check "pg_log"

for the audit entries. But my issue is that I can't find the log file at
all?

In my main PostgreSQL directory (/work/PostgreSQL/10)I do have a file

called "logfile", but there are no entries from today. When I go into the
pgaudit sub-directory (/work/PostegreSQL/10/pgaudit)

I don't see any log file in there either?

pgaudit writes in the standard pgsql log.

Can someone point me in the right direction?

Thanks,
Dave Hughes

--
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt