pgaudit

What it is

pgAudit adds detailed session and object audit logging to PostgreSQL's standard logging facility. It records statements in an audit-oriented format that is easier to filter and review than ordinary diagnostic logs.

What it provides

• Session auditing by statement class, such as read, write, DDL, role, and function
• Object-level auditing for selected relations
• Structured audit records suitable for security and compliance pipelines

Use it for compliance evidence, privileged-access monitoring, change investigations, security incident response, or regulated systems that need a reviewable database activity trail.

Use it with Rent

extension pgaudit {
  name = "pgaudit"
}

The RSL declaration makes installation and migration intent part of the reviewed application schema. Register the typed pack at runtime to call its APIs:

let audit = extensions.register_pack::<PgAudit>()?;
let settings = AuditSettings::new(
    &audit,
    [AuditClass::Read, AuditClass::Write],
);

assert_eq!(settings.class_setting(), "read,write");

audit
    .client(&pool)
    .configure_database(&settings)
    .await?;

This writes database-level defaults with ALTER DATABASE, so newly opened connections receive the audit policy. Existing pooled connections retain their settings until they are replaced. All three settings are applied in one server statement: if the role lacks privileges for any of them, the database keeps every previous default and the call returns an error. The role applying the defaults must have the required PostgreSQL privileges.

Audit one transaction

Use a transaction-bound client for temporary settings:

client
    .transaction_app(async |tx| -> anyhow::Result<()> {
        audit
            .client(tx)
            .configure_transaction(&settings)
            .await?;

        tx.create_post()
            .title("Published post")
            .author_id(author.id)
            .save()
            .await?;

        Ok(())
    })
    .await?;

The settings apply to this transaction's connection and are restored on commit or rollback. Calling configure_transaction on a pool returns an actionable error before executing SQL. PostgreSQL still enforces audit-configuration privileges; this API does not grant them. An empty audit-class list means none.

Audit records go to PostgreSQL's configured log destination, not the query result. Keep log_parameter disabled unless your logging policy permits recording application values. Database auditing records attempted activity; rolling back an application write does not erase its audit record.

pgaudit is cluster-scoped and may require provider control-plane work. Rent surfaces that during preflight instead of emitting misleading installation SQL.

Run the application

cargo run -p rent --example extension_14_pgaudit

Set DATABASE_URL to a disposable PostgreSQL server with pgAudit preloaded. The example creates and removes an isolated database, so the supplied role needs database-creation and extension-installation privileges. It checks settings inside a publication transaction, restoration after commit and rollback, rejected pool execution, closed handles, and insufficient privileges. Its reusable source is crates/rent/examples/extension_14_pgaudit/workflow.rs; nextest runs the same application in the extension matrix. Its standalone extension declaration is crates/rent/examples/extension_14_pgaudit/schema.rsl.