On 14 October 2014 20:33, Abhijit Menon-Sen <ams@2ndquadrant.com> wrote:
> At 2014-10-14 20:09:50 +0100, simon@2ndQuadrant.com wrote:
>>
>> I think that's a good idea.
>>
>> We could have pg_audit.roles = 'audit1, audit2'
>
> Yes, it's a neat idea, and we could certainly do that. But why is it any
> better than "ALTER ROLE audit_rw SET pgaudit.log = …" and granting that
> role to the users whose actions you want to audit?
That would make auditing visible to the user, who may then be able to
do something about it.
Stephen's suggestion allows auditing to be conducted without the
users/apps being aware it is taking place.
-- Simon Riggs http://www.2ndQuadrant.com/PostgreSQL Development, 24x7 Support, Training & Services