Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[doc][ybm] pgaudit settings #23982

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
+14 −16
Open

[doc][ybm] pgaudit settings #23982

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f204b2a
pgaudit settings
ddhodge Sep 17, 2024
9712b4b
Merge branch 'master' into doc_218_ybmaudit
aishwarya24 Sep 19, 2024
0615fbc
review comment
ddhodge Oct 1, 2024
f3612f1
Merge branch 'master' into doc_218_ybmaudit
ddhodge Oct 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 12 additions & 13 deletions docs/content/preview/yugabyte-cloud/cloud-monitor/logging-export.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ type: docs

Export YSQL database logs to third-party tools for security monitoring, to build operations and health dashboards, troubleshooting, and more. You can export the following types of logs:

- Database query logging. This is the standard [PostgreSQL logging](https://www.postgresql.org/docs/11/runtime-config-logging.html) facility. Using these settings you can log query statements and errors.
<!-- Database audit logging. Using the [PostgreSQL Audit Extension](https://www.pgaudit.org/#) ([pgaudit](https://github.com/pgaudit/pgaudit/blob/1.3.2/README.md)), the audit log provides the exact database transactions, which is a compliance requirement for government, financial, or ISO certifications.
-->
Note that YugabyteDB is based on PostgreSQL 11<!-- and uses pgaudit v1.3.2-->.
- [Database query logging](#database-query-logging). This is the standard [PostgreSQL logging](https://www.postgresql.org/docs/11/runtime-config-logging.html) facility. Using these settings you can log query statements and errors.
- [Database audit logging](#database-audit-logging). Using the [PostgreSQL Audit Extension](https://www.pgaudit.org/#) ([pgaudit](https://github.com/pgaudit/pgaudit/blob/1.3.2/README.md)), the audit log provides the exact database transactions, which is a compliance requirement for government, financial, or ISO certifications.

Note that YugabyteDB is based on PostgreSQL 11 and uses pgaudit v1.3.2.

Exporting logs may incur additional costs for network transfer in a cloud region, between cloud regions, and across the Internet. Refer to [Data transfer costs](../../cloud-admin/cloud-billing-costs/#data-transfer-costs).

Expand All @@ -43,7 +43,7 @@ To enable database query logging for a cluster, do the following:

YugabyteDB Aeon begins the (rolling) restart.

Logs are exported to the third-party tool in near real time. After the setup is complete and YSQL database queries are submitted, verify that the YSQL database query logs are visible in the tool; they should be available in minutes. Logs are exported with preset tags and a [log line prefix](#include-in-the-log-prefix-log-line-prefix) so that you can filter them further by cloud, region, availability zone, cluster_id, node-type, and node-name. Depending on your tool, you can also perform text searches of the logs.
Logs are exported to the third-party tool in near real time. After the setup is complete and YSQL database queries are submitted, verify that the YSQL database query logs are visible in the tool; they should be available in minutes. Logs are exported with preset tags and a [log line prefix](#include-in-the-log-prefix-log-line-prefix) so that you can filter them further by cloud, region, availability zone, cluster ID, node type, and node name. Depending on your tool, you can also perform text searches of the logs.

### Logging settings

Expand Down Expand Up @@ -105,9 +105,10 @@ Log the duration of all completed statements. Statement text is not included. Us

Log the duration and statement text of all statements that ran for the specified duration (in ms) or longer. Use this setting to identify slow queries. If a statement has been logged for [Log SQL statements](#log-sql-statements-log-statement), the text is not repeated in the duration log message.

Setting this option to 0 logs all statements, with their duration, which is not recommended unless you have low traffic. You should set this to a reasonable value for your application (for example, 1000 milliseconds)<!--, or use [log sampling](#sample-statements-with-duration-log_min_duration_sample-and-log_statement_sample_rate).This setting overrides [the sampling setting](#sample-statements-with-duration-log_min_duration_sample-and-log_statement_sample_rate); queries exceeding the minimum duration are not subject to sampling and are always logged -->.
Setting this option to 0 logs all statements, with their duration, which is not recommended unless you have low traffic. You should set this to a reasonable value for your application (for example, 1000 milliseconds).

<!--Alternatively, you can use [log sampling](#sample-statements-with-duration-log-min-duration-sample-and-log-statement-sample-rate). log_min_duration_statement overrides the sampling setting: queries exceeding the minimum duration are not subject to sampling and are always logged.

<!--
##### Sample statements with duration (log_min_duration_sample and log_statement_sample_rate)

Log a sampling of statements that ran for a specified duration (in ms) or longer. These options are used together, typically to identify slow queries while minimizing the performance impact on high traffic clusters.
Expand All @@ -129,12 +130,11 @@ Log all connection attempts, along with successfully completed client authentica

Log session termination and duration of the session.

<!--
## Database Audit Log
## Database Audit Logging

To enable database audit logging for a cluster, do the following:

1. On the cluster **Settings** tab, select **Database Audit Log**.
1. On the cluster **Settings** tab, select **Database Audit Logging**.
1. Click **Enable Database Audit Logging**.
1. Select the YSQL statements to log.

Expand All @@ -145,15 +145,15 @@ To enable database audit logging for a cluster, do the following:
- **DDL** - All DDL that is not included in the ROLE class.
- **Misc** - Miscellaneous commands, such as DISCARD, FETCH, CHECKPOINT, VACUUM, and SET.

1. Configure the [YSQL audit log settings](#ysql-audit-log-settings).
1. Configure the [YSQL audit log settings](#ysql-audit-loggng-settings).

1. Select the export configuration to use.

1. Click **Enable Database Audit Logging**.

YugabyteDB Aeon begins the rolling restart.

### YSQL audit log settings
### YSQL audit logging settings

The YSQL audit logging settings are derived from the settings for logging used by the pgaudit extension. Statements are always logged.

Expand All @@ -171,4 +171,3 @@ The YSQL audit logging settings are derived from the settings for logging used b
- [Logging in YugabyteDB](../../../secure/audit-logging/)
- [PostgreSQL Error Reporting and Logging](https://www.postgresql.org/docs/11/runtime-config-logging.html)
- [Annotated PostgreSQL configuration settings](https://github.com/jberkus/annotated.conf)
-->
5 changes: 2 additions & 3 deletions ...omation/managed-cli/managed-cli-reference/managed-cli-db-audit-logs-exporter.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<!---
---
title: ybm CLI db-audit-logs-exporter resource
headerTitle: ybm db-audit-logs-exporter
linkTitle: db-audit-logs-exporter
Expand All @@ -10,8 +10,7 @@ menu:
parent: managed-cli-reference
weight: 20
type: docs
private: true
--->
---

Use the `db-audit-logs-exporter` resource to configure [database audit logs](../../../../cloud-monitor/logging-export/) for export to third-party tools.

Expand Down