Skip to content

Commit a9fdb99

Browse files
authored
Add audit doc (#732)
* doc: add auditlog docs, initial review * doc: add path to redirect map * fix: remove from redirect * doc: update audit command
1 parent ed0cfe8 commit a9fdb99

File tree

1 file changed

+51
-0
lines changed

1 file changed

+51
-0
lines changed
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
tags: [postgres, audit, troubleshooting, how-to]
3+
---
4+
5+
# Audit logging
6+
7+
!!! info "Only available for postgreSQL in GCP"
8+
9+
The cli used for this configuration can only detect sql instances in GCP.
10+
11+
This guide describes how to enable audit logging in your postgreSQL database.
12+
13+
The following steps need to be taken to enable the logging.
14+
15+
1. [Configure database flags](#configure-database-flags-for-your-sql-instance), and configure replication etc.
16+
2. [Configure database internals](#use-the-nais-cli-to-configure-database-internals) to be the primary.
17+
18+
For more information on audit logging, see the [official documentation](https://cloud.google.com/sql/docs/postgres/pg-audit).
19+
20+
## Configure database flags for your sql instance
21+
22+
```text
23+
$ cloudsql.enable_pgaudit = on
24+
$ pgaudit = read | write | all
25+
```
26+
27+
Example application spec:
28+
29+
```yaml
30+
spec:
31+
gcp:
32+
sqlInstances:
33+
- name: myapp
34+
flags:
35+
- name: "cloudsql.enable_pgaudit"
36+
value: "on"
37+
- name: "pgaudit.log"
38+
value: "write"
39+
```
40+
41+
## Use the nais cli to configure database internals
42+
43+
The nais cli can be used to configure the database internals. This will fail if the necessary database flags have not been configured.
44+
The cli will log on to your database and create the pgaudit extension and also disable logging for the application user.
45+
46+
```shell
47+
$ nais postgres enable-audit <application> <namespace> <context>
48+
```
49+
The application is required, the current namespace and context will be used if these are not specified.
50+
51+
For more information on the nais cli, see the [official documentation](https://doc.nais.io/cli).

0 commit comments

Comments
 (0)