{"id":12341,"date":"2019-04-01T18:20:07","date_gmt":"2019-04-01T16:20:07","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/"},"modified":"2019-04-01T18:20:07","modified_gmt":"2019-04-01T16:20:07","slug":"the-edb-filter-log-extension","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/","title":{"rendered":"The EDB filter log extension"},"content":{"rendered":"<p>This is another post dedicated to EnterpriseDB Postgres. Sometimes you may want to get specific messages not getting logged to the server&#8217;s logfile or audit records. That might be specific error codes or, even more important, passwords you specify when you create users. EDB comes with a solution for that by providing an extension which is called EDB Filter Log. Lets see how you can install, and even more important, how to use that extension.<\/p>\n<p><!--more--><\/p>\n<p>The first thing I usually do when I want to check what extensions are available is looking at <a href=\"pg_available_extensions\" target=\"_blank\" rel=\"noopener noreferrer\"><\/a>. I was quite surprised that this extension is not listed there:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# select * from pg_available_extensions where name like '%filter%';\n name | default_version | installed_version | comment \n------+-----------------+-------------------+---------\n(0 rows)\n<\/pre>\n<p>Anyway you can load it by adjusting the <a href=\"\" target=\"_blank\" rel=\"noopener noreferrer\">shared_preload_libraries<\/a> parameter:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# show shared_preload_libraries;\n             shared_preload_libraries              \n---------------------------------------------------\n $libdir\/dbms_pipe,$libdir\/edb_gen,$libdir\/dbms_aq\n(1 row)\nedb=# alter system set shared_preload_libraries='$libdir\/dbms_pipe,$libdir\/edb_gen,$libdir\/dbms_aq,$libdir\/edb_filter_log';\nALTER SYSTEM\nedb=# q\nenterprisedb@edb1:\/var\/lib\/edb\/ [pg1] pg_ctl -D $PGDATA restart -m fast\nenterprisedb@edb1:\/var\/lib\/edb\/ [pg1] psql edb\npsql.bin (11.2.9)\nType \"help\" for help.\n\n\nedb=# show shared_preload_libraries ;\n                         shared_preload_libraries                         \n--------------------------------------------------------------------------\n $libdir\/dbms_pipe,$libdir\/edb_gen,$libdir\/dbms_aq,$libdir\/edb_filter_log\n(1 row)\n<\/pre>\n<p>But even then the extension does not show up in pg_available_extensions:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# select * from pg_available_extensions where name like '%filter%';\n name | default_version | installed_version | comment \n------+-----------------+-------------------+---------\n(0 rows)\n<\/pre>\n<p>Lets assume you do not want violations on unique constraints to get logged in the server&#8217;s logfile. Usually you get this in the log file once a constraint is violated:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# create table t1 ( a int );\nCREATE TABLE\nedb=# create unique index i1 on t1(a);\nCREATE INDEX\nedb=# insert into t1 values(1);\nINSERT 0 1\nedb=# insert into t1 values(1);\nERROR:  duplicate key value violates unique constraint \"i1\"\nDETAIL:  Key (a)=(1) already exists.\nedb=# select pg_current_logfile();\n      pg_current_logfile       \n-------------------------------\n log\/edb-2019-03-24_162021.log\n(1 row)\nedb=# ! tail -20 $PGDATA\/log\/edb-2019-03-24_162021.log\n...\n2019-03-24 16:35:32 CET ERROR:  duplicate key value violates unique constraint \"i1\"\n2019-03-24 16:35:32 CET DETAIL:  Key (a)=(1) already exists.\n...\n<\/pre>\n<p>Using the extension you can do it like this (23505 is the SQLSTATE for unique constraint violations):<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# show edb_filter_log.errcode;\n edb_filter_log.errcode \n------------------------\n \n(1 row)\n\nedb=# alter system set edb_filter_log.errcode='23505';\nALTER SYSTEM\nedb=# select context from pg_settings where name = 'edb_filter_log.errcode';\n context \n---------\n user\n(1 row)\nedb=# select pg_reload_conf();\n pg_reload_conf \n----------------\n t\n(1 row)\n\nedb=# show edb_filter_log.errcode;\n edb_filter_log.errcode \n------------------------\n 23505\n(1 row)\n\nedb=# insert into t1 values(1);\nERROR:  duplicate key value violates unique constraint \"i1\"\nDETAIL:  Key (a)=(1) already exists.\nedb=# ! tail -20 $PGDATA\/log\/edb-2019-03-24_162021.log\n...\n2019-03-24 16:39:05 CET LOG:  received SIGHUP, reloading configuration files\n2019-03-24 16:39:05 CET LOG:  parameter \"edb_filter_log.errcode\" changed to \"23505\"\nedb=# \n<\/pre>\n<p>This specific error is not any more reported in the logfile. Of course can use multiple codes for edb_filter_log.errcode by separating them with a comma. The complete list of codes is documented <a href=\"https:\/\/www.postgresql.org\/docs\/current\/static\/errcodes-appendix.html\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a>.<\/p>\n<p>This is for suppressing messages in the log file. What about passwords? Imagine you are logging all statements:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# alter system set log_statement='all';\nALTER SYSTEM\nedb=# select pg_reload_conf();\n pg_reload_conf \n----------------\n t\n(1 row)\n\nedb=# show log_statement;\n log_statement \n---------------\n all\n(1 row)\n<\/pre>\n<p>In this configuration this will be captured as well and you will find the password in the logfile:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# create user u1 with login password 'password';\nCREATE ROLE\nedb=# select pg_current_logfile();\n      pg_current_logfile       \n-------------------------------\n log\/edb-2019-03-24_162021.log\nedb=# ! tail -20 $PGDATA\/log\/edb-2019-03-24_162021.log | grep password\n\n2019-03-24 16:46:59 CET LOG:  statement: create user u1 with login password 'password';\n<\/pre>\n<p>This is what you usually do not want to see there and exactly this is what &#8220;edb_filter_log.redact_password_commands&#8221; is for:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# alter system set edb_filter_log.redact_password_commands = true;\nALTER SYSTEM\nedb=# select pg_reload_conf();\n pg_reload_conf \n----------------\n t\n(1 row)\n\nedb=# show edb_filter_log.redact_password_commands;\n edb_filter_log.redact_password_commands \n-----------------------------------------\n on\n(1 row)\n<\/pre>\n<p>When this is set to on the plain text password will not be anymore written to the log file when you create or alter users:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# ! tail -20 $PGDATA\/log\/edb-2019-03-24_162021.log | grep secret\n2019-03-24 16:51:19 CET STATEMENT:  create user u2 login with password 'secret';\n2019-03-24 16:51:28 CET LOG:  statement: create user u2 with login password 'secret';\n<\/pre>\n<p>&#8230; and it is still there. A restart is required for that becoming active?:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nenterprisedb@edb1:\/var\/lib\/edb\/as11\/data\/ [pg1] pg_ctl -D $PGDATA restart -m fast\nenterprisedb@edb1:\/var\/lib\/edb\/as11\/data\/ [pg1] psql -X edb\npsql.bin (11.2.9)\nType \"help\" for help.\n\nedb=# create user u3 with login password 'topsecret';\nCREATE ROLE\nedb=# select pg_current_logfile();\n      pg_current_logfile       \n-------------------------------\n log\/edb-2019-03-24_165229.log\n(1 row)\n\nedb=# ! tail -20 $PGDATA\/log\/edb-2019-03-24_165229.log | grep topsecret\n2019-03-24 16:54:22 CET LOG:  statement: create user u3 with login password 'topsecret';\n<\/pre>\n<p>And we do still see it in the log file, why that? The issue is with the syntax. Consider this:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\nedb=# create user u4 with login password 'text';\nCREATE ROLE\nedb=# create user u5 login password 'text2';\nCREATE ROLE\nedb=# create user u6 password 'text3';\nCREATE ROLE\nedb=# \n<\/pre>\n<p>Only the last command will replace the password in the log file:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\n2019-03-24 17:03:31 CET LOG:  statement: create user u4 with login password 'text';\n2019-03-24 17:03:45 CET LOG:  statement: create user u5 login password 'text2';\n2019-03-24 17:04:12 CET LOG:  statement: create user u6 password 'x';\n<\/pre>\n<p>You have to follow exactly this syntax:<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">\n{CREATE|ALTER} {USER|ROLE|GROUP} identifier { [WITH] [ENCRYPTED]\nPASSWORD 'nonempty_string_literal' | IDENTIFIED BY {\n'nonempty_string_literal' | bareword } } [ REPLACE {\n'nonempty_string_literal' | bareword } ]\n<\/pre>\n<p>&#8230;otherwise it will not work.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is another post dedicated to EnterpriseDB Postgres. Sometimes you may want to get specific messages not getting logged to the server&#8217;s logfile or audit records. That might be specific error codes or, even more important, passwords you specify when you create users. EDB comes with a solution for that by providing an extension which [&hellip;]<\/p>\n","protected":false},"author":28,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[229],"tags":[713,77],"type_dbi":[],"class_list":["post-12341","post","type-post","status-publish","format-standard","hentry","category-database-administration-monitoring","tag-enterprisedb","tag-postgresql"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.8 (Yoast SEO v28.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>The EDB filter log extension - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The EDB filter log extension\" \/>\n<meta property=\"og:description\" content=\"This is another post dedicated to EnterpriseDB Postgres. Sometimes you may want to get specific messages not getting logged to the server&#8217;s logfile or audit records. That might be specific error codes or, even more important, passwords you specify when you create users. EDB comes with a solution for that by providing an extension which [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-04-01T16:20:07+00:00\" \/>\n<meta name=\"author\" content=\"Open source Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Open source Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/the-edb-filter-log-extension\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/the-edb-filter-log-extension\\\/\"},\"author\":{\"name\":\"Open source Team\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\"},\"headline\":\"The EDB filter log extension\",\"datePublished\":\"2019-04-01T16:20:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/the-edb-filter-log-extension\\\/\"},\"wordCount\":360,\"commentCount\":0,\"keywords\":[\"enterprisedb\",\"PostgreSQL\"],\"articleSection\":[\"Database Administration &amp; Monitoring\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/the-edb-filter-log-extension\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/the-edb-filter-log-extension\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/the-edb-filter-log-extension\\\/\",\"name\":\"The EDB filter log extension - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"datePublished\":\"2019-04-01T16:20:07+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/the-edb-filter-log-extension\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/the-edb-filter-log-extension\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/the-edb-filter-log-extension\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The EDB filter log extension\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\",\"name\":\"Open source Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"caption\":\"Open source Team\"},\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/open-source-team\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"The EDB filter log extension - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/","og_locale":"en_US","og_type":"article","og_title":"The EDB filter log extension","og_description":"This is another post dedicated to EnterpriseDB Postgres. Sometimes you may want to get specific messages not getting logged to the server&#8217;s logfile or audit records. That might be specific error codes or, even more important, passwords you specify when you create users. EDB comes with a solution for that by providing an extension which [&hellip;]","og_url":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/","og_site_name":"dbi Blog","article_published_time":"2019-04-01T16:20:07+00:00","author":"Open source Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Open source Team","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/"},"author":{"name":"Open source Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202"},"headline":"The EDB filter log extension","datePublished":"2019-04-01T16:20:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/"},"wordCount":360,"commentCount":0,"keywords":["enterprisedb","PostgreSQL"],"articleSection":["Database Administration &amp; Monitoring"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/","url":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/","name":"The EDB filter log extension - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2019-04-01T16:20:07+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/the-edb-filter-log-extension\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"The EDB filter log extension"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202","name":"Open source Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","caption":"Open source Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/open-source-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/12341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=12341"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/12341\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=12341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=12341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=12341"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=12341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}