Why should you care?

PostgresVerse bank must prove who ran DROP TABLE — pgaudit object audit feeds Splunk alerts.

See it live — copy this example

Run in pgAdmin or psql.

# postgresql.conf (conceptual)
shared_preload_libraries = 'pgaudit'
pgaudit.log = 'ddl, role'
pgaudit.log_relation = on

-- after reload, run:
CREATE TABLE audit_test (id int);
DROP TABLE audit_test;

Run Example »

This lesson uses terminal or setup steps. Run commands on your computer — the live editor appears on coding lessons.

What happened?

• pgaudit logs DDL like CREATE/DROP to server log with user and timestamp.
• log_relation adds table names.
• SIEM parses postgresql-*.log for compliance.

Practice next

1. Install pgaudit if available on your build.
2. Set config and reload postgres.
3. Run DDL sample and tail log file.
4. pgaudit.log_catalog off to reduce noise.
5. Test alert on DROP TABLE pattern in log pipeline.

Remember

pgaudit extends standard logging for compliance. Filter classes: ddl, write, read, role. Correlate with pg_stat_activity session ids.

PostgresVerse SOC integration

DROP in production triggers PagerDuty from pgaudit log within 60s.

Outcome: Insider threat and compromised creds detected fast.