Allow configuringpgaudit.log_parameter#20183
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
-
pgaudit is the recommended method to log according to the docs:https://supabase.com/docs/guides/database/extensions/pgaudit I'd like to verify the call parameters of the RPCs called via postgREST, but I am not able to alter pgaudit.log_parameter due to a permission error:
To ReproduceConnect to the database as postgres or use the SQL Editor from the dashboard and run either of the following: Expected behaviorI expect to be able to set log_parameter and audit the parameters sent to the RPC. ScreenshotsSystem informationAdditional contextPostgres version: 15.1.0.113 |
BetaWas this translation helpful?Give feedback.
All reactions
Replies: 3 comments 6 replies
-
I'll note that I found a way to access the (URL Encoded) parameters for the RPCs from the API Edge Network Logs > Request Metadata > Search. It's not exactly what I was looking for, but it's something! |
BetaWas this translation helpful?Give feedback.
All reactions
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
-
Hi@xEverth! Currently configuring One workaround for this is usingtriggers. I've converted this issue to a feature request to gauge interest - if enough people want this restriction lifted we may reconsider removing this restriction. |
BetaWas this translation helpful?Give feedback.
All reactions
-
would love this feature for temporary troubleshooting |
BetaWas this translation helpful?Give feedback.
All reactions
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
-
Would also love to be able to use this for troubleshooting. We've got a very difficult problem taking our whole instance down at random. There's not enough information in the logs for us to diagnose. We don't use pgsodium or vault so we're not concerned about leaking any encrypted data to logs. |
BetaWas this translation helpful?Give feedback.
All reactions
👍 2
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
-
@soedirgo sadly, the trigger-based approach doesn't allow for logging reads (SELECT), and without parameter binding, it is impossible to be compliant with the strict auditing requirements over here in Europe (know which specific records/rows have been accessed) - especially in healthcare. We're self-hosting, and while |
BetaWas this translation helpful?Give feedback.
All reactions
-
If you're self-hosting, you should be able to modify it by connecting as |
BetaWas this translation helpful?Give feedback.
All reactions
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
-
Worked, thanks! What's the technical explanation for this? Even with the postgres role, I got no permission error, and the setting was persistent across sessions and restarts globally: → looks exactly the same after regardless of whether I set it with postgres or supabase_admin
|
BetaWas this translation helpful?Give feedback.
All reactions
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
-
Correction: |
BetaWas this translation helpful?Give feedback.
All reactions
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
-
Yes, but it does show the parameters now after setting it with supabase_admin. Maybe some overnight replication magic happened, but I restarted multiple times after setting it with postgres and it continuously showed |
BetaWas this translation helpful?Give feedback.
All reactions
👍 1
This discussion was converted from issue #19955 on January 05, 2024 08:34.


