pgaudit | PostgreSQL Audit Extension | Database library

log_statement=ddl as a flag allows for logging DDL statements without using pgAudit, so the majority of the setup was unnecessary. Set this flag and the operations I needed are now logged.

I really hope nobody else runs across this, but finally I found the problem and for once it was not only between the chair and the monitor, but also RTFM was involved.

As mentioned I am using minikube to run my k8s cluster which provides PVs stored on the host disk. Where it is stored you may ask? Exaclty, here: /tmp/hostpath-provisioner/default/data-sessiondb-0/data/. You find the problem? No, I also took some time to figure it out. WHY ON EARTH does minikube use the tmp folder to store persistant volume claims?

This folder gets autom. cleared every now and so on.

SOLUTION: Change the path and DO NOT STORE PVs IN tmp FOLDERS.

They mention this here: https://minikube.sigs.k8s.io/docs/handbook/persistent_volumes/#a-note-on-mounts-persistence-and-minikube-hosts and give an example.

But why use the "dangerous" tmp path per default and not, let's say, data without putting a Warning banner there?

Sigh. Closing this question ^^

--> Workaround: https://github.com/kubernetes/minikube/issues/7511#issuecomment-612099413

Github issues to this topic:

• https://github.com/kubernetes/minikube/issues/7511
• https://github.com/kubernetes/minikube/issues/13038
• https://github.com/kubernetes/minikube/issues/3318
• https://github.com/kubernetes/minikube/issues/5144

My Github issue for clarification in the docs: https://github.com/kubernetes/minikube/issues/13038#issuecomment-981821696

pvc thats gets created as a part of statefulset will have a name which is an amalgamation of 3 components joined by - :

1. Name defined in the volumeClaimTemplates section data
2. Name of the statefulset in the metadata section which is reddwarf-postgresql-postgresql
3. Its replica number , if it is first replica then it would be 0

So finally the name of the pvc that gets created when you create this statefulset is data-reddwarf-postgresql-postgresql-0.which is the pvc name that you also seeing in your setup.

please note when you delete the statefulset , pvc does not deleted automatically we need to pvc separately. When you recreate/scaleup the stateful set and if the pvc which matches above naming convention& spec does not exists then it will create a pvc.

From kubernetes documentation

How do IAM logs and PgAudit differ, should I enable both or is there redundancy by doing so?

Well the IAM Logs focus on Admin Activity and data access:

• Admin Activity audit logs: Includes "admin write" operations that write metadata or configuration information.
• Data Access audit logs: Includes "admin read" operations that read metadata or configuration information. Also includes "data read" and "data write" operations that read or write user-provided data.

On the other hand the pgAudit extension applies to executed SQL commands and queries.

Basic statement logging can be provided by the standard logging facility with log_statement = all. This is acceptable for monitoring and other usages but does not provide the level of detail generally required for an audit. It is not enough to have a list of all the operations performed against the database. It must also be possible to find particular statements that are of interest to an auditor. The standard logging facility shows what the user requested, while pgAudit focuses on the details of what happened while the database was satisfying the request.

For HIPAA compliance using PgAudit, should I log all or is there another value that makes sense

When it comes to HIPAA compliance, I do not have any experience in the topic, but in this page it is mentioned that part of the Technical safeguards of HIPAA security rule is to introduce activity logs and audit controls.

Maybe combining the IAM logs (Who did what, where, and when?) with the pgAudit(executed commands and queries) will provide better coverage to face this implementation specification.

If you open the link that Bitnami helpfully provided you right there in the output you can find the documentation for the image. https://github.com/bitnami/bitnami-docker-postgresql#configuration-file seems to be the most relevant part to you though.

This is a long lasting and yet not-resolved issue with TF, already reported on GitHub:

• Modify aws_db_instance and delete aws_db_parameter_group breaks

You have to do it manually for now.

Depending on the versions of Ubuntu and PostgreSQL you may not need to clone the Git repository of pgAudit and compile it from the sources.

For example, Ubuntu 20.04 has a package named postgresql-12-pgaudit which may be what you need. To install it, open your terminal and type

you just have to run the query before the describe block, strip it and then use expect on it. something like:

Add in postgresql.conf: