Audit Logging System

Planned

Built-in audit logging is planned for HeliosDB Lite. In the current release the [audit] section of config.toml is accepted but has no effect, and no __audit_log table is written. To keep an audit trail today, record changes with triggers (see Recording changes with triggers).

Planned Design

The audit log will record, per operation:

• What: DDL (CREATE, ALTER, DROP), DML (INSERT, UPDATE, DELETE), and optionally SELECT and transaction statements (BEGIN, COMMIT, ROLLBACK).
• Who and when: user, session, timestamp.
• Outcome: affected rows, success or failure, error message.
• Integrity: a SHA-256 checksum per event for tamper detection.

It will be queryable with SQL from an append-only __audit_log table and configured in the [audit] section of config.toml:

[audit]
enabled = true
log_ddl = true
log_dml = true
log_select = false
log_transactions = false
log_auth = true
retention_days = 90
enable_checksums = true
max_query_length = 10000

Recording Changes with Triggers

Until built-in audit logging is available, AFTER INSERT OR UPDATE OR DELETE triggers on sensitive tables can write each change to an audit table you own. Grant auditors SELECT on that table and revoke write access from application roles. See Triggers and Procedural Language for the syntax.

Related Controls Available Today

• Encryption at rest: Encryption Quick Start
• Encryption in transit: PostgreSQL SSL/TLS Configuration
• Access control: SQL roles, GRANT / REVOKE and row-level security
• Point-in-time reads: Time-Travel Queries show what a row contained at an earlier time