Skip to content

Reading view emit a audit log as UNKNOWN #27

@MasahikoSawada

Description

@MasahikoSawada

While testing I noticed that pgaudit emits a UNKNOWN type log when reading view. This behavior seems same as what advanced branch doing.

  • In advanced branch (with format 'HOGE : user = %user, class = %class,tag = %command_tag, type = %object_type, text = %command_text')
LOG:  HOGE : user = masahiko, class = READ MISC MISC, tag = SELECT UNKNOWN SELECT, type = VIEW VIEW TABLE, text = select * from hoge_view;
  • In refactored branch
NOTICE:  AUDIT: SESSION,1,1,READ,2017-02-13 20:06:52 JST,postgres,masahiko,[local],psql,2/30,0,,,SELECT,VIEW,public.hoge_view,select * from hoge_view;,<not logged>
NOTICE:  AUDIT: SESSION,1,1,MISC,2017-02-13 20:12:28 JST,postgres,masahiko,[local],psql,2/30,0,,,UNKNOWN,VIEW,public.hoge_view,select * from hoge_view;,<not logged>
NOTICE:  AUDIT: SESSION,1,1,READ,2017-02-13 20:12:28 JST,postgres,masahiko,[local],psql,2/30,0,,,SELECT,TABLE,public.hoge,select * from hoge_view;,<not logged>

This cause is that old and new column are added when rewriting query. So these SELECT, UNKNOWN and SELECT are corresponding to old column, new column and the table. I understand the cause of this but I'm not sure how we can fix it. Issued to not forget it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions