View audit logs generated by pgAudit for AlloyDB for PostgreSQL

To monitor database activity and help meet government, financial, and ISO compliance requirements, you can view and query the Data Access audit logs generated by pgAudit for AlloyDB for PostgreSQL in Cloud Logging. You can also inspect the pgAudit log entry format and monitor the audit logging pipeline status in Cloud Monitoring. For more information about pgAudit, see About pgAudit.

Before you begin

To view audit logs, you must do the following:

View audit logs

The generated pgAudit logs for a given instance are sent to Cloud Logging as Data Access audit logs.

You can view the generated pgAudit logs by using the Logs Explorer application.

To view the pgAudit logs, select the cloudaudit.googleapis.com/data_access log filter in the Logs Explorer application.

To view all pgAudit logs for an AlloyDB project, execute the following query by using the Advanced Filter interface:

resource.type="alloydb.googleapis.com/Instance"
logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access"
protoPayload.request.@type="type.googleapis.com/google.cloud.alloydb.audit.v1.PgAuditEntry"

Replace PROJECT_ID with the ID of your AlloyDB project.

Log format for pgAudit

Each pgAudit log entry in the Data Access audit logs contains fields that represent the information collected for a query. For more information about these log entry fields, see the pgAudit documentation.

Sample pgAudit log entry:

{
  protoPayload: {
    @type: "type.googleapis.com/google.cloud.audit.AuditLog"
    methodName: "alloydb.instances.query"
    request: {
      @type: "type.googleapis.com/google.cloud.alloydb.audit.v1.PgAuditEntry"
      auditClass: "READ"
      auditType: "SESSION"
      chunkCount: "1"
      chunkIndex: "1"
      command: "SELECT"
      database: "finance"
      databaseSessionId: 2209692
      parameter: "[not logged]"
      statement: "SELECT * FROM revenue"
      statementId: 2
      substatementId: 1
      user: "alice"
    }
  }
}

The following are descriptions of the fields in the Data Access audit logs:

  • auditClass. The type of the statement that is logged. Possible values are READ, WRITE, FUNCTION, ROLE, DDL, MISC, and MISC_SET.
  • auditType. SESSION or OBJECT.
  • chunkCount. Chunking can occur on the data provided in the parameter and statement fields. The chunkCount field indicates the total number of chunks. Also see the description of the chunkIndex field.
  • chunkIndex. Specifies the index number of the data chunks in the parameter and statement fields in the current request container. The initial number is 1. Also see the description of the chunkCount field.
  • command. For example, ALTER TABLE or SELECT.
  • parameter. The chunkIndex field can determine the contents of this field; see the description of the chunkIndex field. If the value for the pgaudit.log_parameter flag is set, the parameter field can contain the statement parameters as quoted CSV data. If there are no parameters, this field contains [none]. Otherwise, this field contains [not logged].
  • statement. Statement that is executed on the backend. The chunkIndex field can determine the contents of the statement field; see the description of the chunkIndex field.
  • statementId. Unique statement ID for this session. Each statement ID represents a backend call. Statement IDs are sequential, even if some statements aren't logged.
  • substatementId. Sequential ID for each sub-statement within the main statement.

Monitor audit log pipeline status

AlloyDB processes user-generated audit logs asynchronously before securely forwarding them to Cloud Logging. You can monitor the status, throughput, and backlog of the audit logging pipeline for your instances and nodes using Cloud Monitoring.

The following metrics are available on the alloydb.googleapis.com/InstanceNode monitored resource in the Metrics Explorer:

Metric name Display name Metric kind / Value type Unit Description
alloydb.googleapis.com/node/database/logging/audit/backlog_bytes_count Audit log backlog size GAUGE / INT64 Bytes (By) The size, in bytes, of the audit log backlog on the node awaiting processing and upload to Cloud Logging. A sustained high or increasing value indicates backpressure in the audit log forwarding pipeline.
alloydb.googleapis.com/node/database/logging/audit/processed_bytes_count Processed audit log bytes DELTA / INT64 Bytes (By) The total number of bytes of audit log data successfully processed and forwarded to Cloud Logging from the node.
alloydb.googleapis.com/node/database/logging/audit/processed_entries_count Processed audit log entries DELTA / INT64 Count (1) The total number of audit log entries successfully processed and forwarded to Cloud Logging from the node.

For more information, see the System insights metrics reference.

What's next