Log audit-PolarDB(PolarDB)-阿里云帮助中心

PolarDB for PostgreSQL Lightweight Edition provides audit logs that allow database administrators to track and analyze database activity.

Log printing

PolarDB for PostgreSQL Lightweight Edition creates three types of log files by default:

Audit log (_audit.log): Records all executed SQL statements by default (log_statement='all').
Slow query log (_slow.log): Records SQL statements whose running time exceeds the value of log_min_duration_statement (in milliseconds).
Error log (_error.log): Records SQL statements that failed to execute and system error messages.

Log Processing Mechanism

In PolarDB for PostgreSQL Lightweight Edition, execution processes send relevant logs to the syslogger process for printing. Because a single syslogger process has performance limitations, PolarDB supports configuring multiple syslogger processes for log printing. When multiple syslogger processes are used, the first process (logger 0) prints error logs and slow query logs. The other processes (logger 1, logger 2, and so on) print audit logs. Each syslogger process that handles audit logs prints to a separate log file. Therefore, if multiple audit log processes exist, multiple audit log files are printed in parallel. The log filename suffix consists of the syslogger index and the filename suffix. For example, when multiple processes run in parallel, the audit log printed by the logger 1 process has the suffix _1_audit.log.

Log audit parameter settings

In addition to the basic log printing parameters, PolarDB for PostgreSQL Lightweight Edition supports the following audit log parameters.

Parameter	Description
polar_enable_multi_syslogger	Specifies whether to enable multiple `syslogger` processes to write logs. This feature is enabled by default. The number of processes is controlled by `polar_num_of_sysloggers`. If you enable multiple `syslogger` processes and the number of processes is greater than 1, the first process (`logger 0`) prints error logs and slow query logs. The other processes (`logger 1`, `logger 2`, and so on) print audit logs.
polar_num_of_sysloggers	The number of `syslogger` processes to use when multiple processes are enabled for writing logs. The default value is 2. A higher number of `syslogger` processes improves audit log printing performance but also consumes more cluster resources. Configure this parameter as needed. Note This parameter can be set only in the configuration file.
polar_enable_syslog_pipe_buffer	Specifies whether to enable the buffer for `backend` processes. This feature is enabled by default. When enabled, audit logs are cached in the backend process buffer until the time specified by `polar_audit_log_flush_timeout` is reached or the buffer space limit (default: 65536 bytes) is met. Once either condition is met, the logs are sent in a batch to the `syslogger` process. If this feature is disabled, audit logs are sent directly to the `syslogger` process after each SQL statement is executed.
polar_enable_syslog_file_buffer	Specifies whether to enable the buffer for the `syslogger` process. This feature is disabled by default. If enabled, audit logs are placed in a buffer before being written to the log file. The logs are written to the file only when the buffer is full.
polar_audit_log_flush_timeout	Sets the timeout period for flushing audit logs. The default value is 10 seconds. If the buffer on the `backend` process is not full, the log data in the buffer is automatically sent to the `syslogger` process after the specified time.
polar_auditlog_max_query_length	Sets the truncation length for printed logs. The default value is 4096 bytes, and the maximum value is 65536 bytes. Logs that exceed this length are truncated. This parameter can be set dynamically.
polar_enable_error_to_audit_log	Specifies whether to record SQL statements that cause errors in the audit log. This feature is enabled by default. When enabled, SQL statements that fail to execute and their error messages are recorded in the audit log.
polar_max_log_files	Sets the maximum number of error log files to retain. The default value is 20.
polar_max_auditlog_files	Sets the maximum number of audit log files to retain. The default value is 20.
polar_max_slowlog_files	Sets the maximum number of slow query log files to retain. The default value is 20.
log_connections	Records the connecting user and database.
log_disconnections	Records the connection duration.

Audit log content

An audit log contains the following information:

Timestamp: Defined by the log_line_prefix parameter. The default value is %m [%p].
Log content: Includes the running time, SQL statement, and SQL parameters.

Example

2020-07-30 08:36:08.042 UTC [19626] LOG:  execute P0_7: UPDATE pgbench_tellers SET tbalance = tbalance + $1 WHERE tid = $2;params: $1 = '-203', $2 = '86'