PostgreSQL Audit Logs

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/database-postgresql/generator.yml \
  --id postgresql \
  --live-mode true

Event Types

Realism Features

• Correlated connections — connection events create entries consumed by disconnection events with matching user/db/pid
• 6-host cluster — primary, replicas, analytics, staging, dev servers with unique agent IDs and OS metadata
• 15 database users — superuser, application, readonly, admin, developer roles with matching application names
• 24 tables across 8 database/schema combinations with weighted access patterns
• Parameterized queries — prepared statement parameters ($1, $2, ...) matching pgAudit format
• Authentication failures — password denials, pg_hba.conf mismatches, nonexistent roles from public IPs
• Database errors — deadlocks, duplicate keys, FK violations, lock timeouts, query cancellations

Sample Output

{
    "@timestamp": "2026-03-04T10:15:42.123456+00:00",
    "event": {
        "action": "SELECT",
        "category": ["database"],
        "dataset": "postgresql.log",
        "duration": 3245000,
        "module": "postgresql",
        "outcome": "success",
        "type": ["access"]
    },
    "message": "AUDIT: SESSION,42,1,READ,SELECT,,,SELECT id, email, name FROM public.users WHERE id = $1,{1042}",
    "postgresql": {
        "log": {
            "database": "app_production",
            "query": "SELECT id, email, name FROM public.users WHERE id = $1",
            "query_name": "SELECT"
        }
    },
    "user": { "name": "app_backend" },
    "source": { "ip": "10.1.3.22", "port": 45321 },
    "service": { "type": "postgresql" }
}

Parameters