|
| 1 | + |
| 2 | +:sectnums: |
| 3 | +:sectnumlevels: 5 |
| 4 | + |
| 5 | += PgAudit |
| 6 | + |
| 7 | +== 概述 |
| 8 | + |
| 9 | +PgAudit 是一个审计扩展,可以为 DDL、DML、DCL 等关键操作生成可追溯的日志记录。通过审计日志,数据库管理员能够满足合规要求、及时发现异常行为,并在出现问题时快速定位责任主体与影响范围。 |
| 10 | + |
| 11 | +== 功能特点 |
| 12 | + |
| 13 | +* *全面审计能力*:记录 `SELECT`、`INSERT`、`UPDATE`、`DELETE`、DDL 命令以及权限变更等操作,帮助构建完整的操作轨迹。 |
| 14 | +* *灵活的审计维度*:支持全局审计、角色审计与对象审计,可按用户、角色、模式或具体操作类型进行精细化配置。 |
| 15 | +* *平滑集成*:复用 PostgreSQL 标准日志子系统,可与 `syslog`、`logrotate` 等工具联动,兼容现有日志采集与分析方案。 |
| 16 | +* *合规支撑*:提供结构化审计日志,便于生成符合金融、政企等行业规范的审计报告。 |
| 17 | +* *安全增强*:通过记录和分析数据库活动,及时发现未授权访问、异常 DML 或潜在数据泄露风险。 |
| 18 | +* *运维优化*:辅助回放操作行为、定位性能瓶颈,支撑 SQL 优化与问题排查。 |
| 19 | + |
| 20 | +== 安装部署 |
| 21 | + |
| 22 | +=== 环境准备 |
| 23 | + |
| 24 | +* 已安装的 IvorySQL 数据库。 |
| 25 | +* 编译工具链:`gcc`、`make`、`tar` 等。 |
| 26 | +* 数据库管理员权限,用于修改 `ivorysql.conf` 并重启数据库实例。 |
| 27 | + |
| 28 | +=== 编译安装 PgAudit |
| 29 | + |
| 30 | +以 PgAudit 18.0 为例: |
| 31 | + |
| 32 | +[source,shell] |
| 33 | +---- |
| 34 | +wget https://github.com/pgaudit/pgaudit/archive/refs/tags/18.0.tar.gz |
| 35 | +tar -xf 18.0.tar.gz |
| 36 | +cd pgaudit-18.0 |
| 37 | +make install USE_PGXS=1 PG_CONFIG=$PGHOME/bin/pg_config |
| 38 | +---- |
| 39 | + |
| 40 | +上述命令依赖环境变量 `PGHOME` 指向安装好的 IvorySQL 主目录。安装成功后,`pgaudit.so` 会被放置到 IvorySQL 的扩展目录中。 |
| 41 | + |
| 42 | +=== 注册扩展前的基础配置 |
| 43 | + |
| 44 | +修改 `ivorysql.conf`,启用插件并设置常用参数: |
| 45 | +---- |
| 46 | +shared_preload_libraries = 'pgaudit' # 需实例重启生效 |
| 47 | +pgaudit.log = 'read, write, ddl' # 审计范围示例,可按需调整 |
| 48 | +---- |
| 49 | + |
| 50 | +重启数据库实例,使共享库配置生效。 |
| 51 | + |
| 52 | +=== 创建扩展并验证 |
| 53 | + |
| 54 | +[source,sql] |
| 55 | +---- |
| 56 | +CREATE EXTENSION IF NOT EXISTS pgaudit; |
| 57 | +SELECT name, |
| 58 | + default_version, |
| 59 | + installed_version, |
| 60 | + comment |
| 61 | + FROM pg_available_extensions |
| 62 | + WHERE name = 'pgaudit'; |
| 63 | +---- |
| 64 | + |
| 65 | +若返回的 `installed_version` 与期望版本一致,说明扩展安装成功。 |
| 66 | + |
| 67 | +== 使用 |
| 68 | + |
| 69 | +执行如下sql示例: |
| 70 | + |
| 71 | +[source,sql] |
| 72 | +---- |
| 73 | +CREATE TABLE audit_demo(id serial PRIMARY KEY, info text); |
| 74 | +INSERT INTO audit_demo(info) VALUES ('pgaudit test'); |
| 75 | +SELECT * FROM audit_demo; |
| 76 | +UPDATE audit_demo SET info = 'pgaudit update' WHERE id = 1; |
| 77 | +DELETE FROM audit_demo WHERE id = 1; |
| 78 | +---- |
| 79 | + |
| 80 | +在数据库服务器上查看审计日志: |
| 81 | + |
| 82 | +[source,shell] |
| 83 | +---- |
| 84 | +tail -f $PGDATA/log/*.log | grep 'AUDIT:' |
| 85 | +---- |
| 86 | + |
| 87 | +[source,text] |
| 88 | +---- |
| 89 | +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,CREATE SEQUENCE,SEQUENCE,public.audit_demo_id_seq,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)",<not logged> |
| 90 | +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,CREATE TABLE,TABLE,public.audit_demo,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)",<not logged> |
| 91 | +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,CREATE INDEX,INDEX,public.audit_demo_pkey,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)",<not logged> |
| 92 | +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,ALTER SEQUENCE,SEQUENCE,public.audit_demo_id_seq,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)",<not logged> |
| 93 | +2025-10-31 15:56:32.117 CST [11451] LOG: AUDIT: SESSION,2,1,WRITE,INSERT,,,INSERT INTO audit_demo(info) VALUES ('pgaudit test'),<not logged> |
| 94 | +2025-10-31 15:56:32.121 CST [11451] LOG: AUDIT: SESSION,3,1,READ,SELECT,,,SELECT * FROM audit_demo,<not logged> |
| 95 | +2025-10-31 15:56:32.122 CST [11451] LOG: AUDIT: SESSION,4,1,WRITE,UPDATE,,,UPDATE audit_demo SET info = 'pgaudit update' WHERE id = 1,<not logged> |
| 96 | +2025-10-31 15:56:32.127 CST [11451] LOG: AUDIT: SESSION,5,1,WRITE,DELETE,,,DELETE FROM audit_demo WHERE id = 1,<not logged> |
| 97 | +---- |
| 98 | + |
| 99 | +若想记录参数的值,打开`pgaudit.log_parameter = 'on'`,效果如下: |
| 100 | +[source,text] |
| 101 | +---- |
| 102 | +ivorysql=# SHOW pgaudit.log_parameter; |
| 103 | +pgaudit.log_parameter |
| 104 | +----------------------- |
| 105 | +on |
| 106 | +(1 row) |
| 107 | +---- |
0 commit comments