Skip to content

Update collector README to reference pg_monitor role for setup instructions #351

Open
@jawnsy

Description

@jawnsy

It looks like the pg_monitor predefined role is sufficient for pganalyze-collector, so granting access should be as simple as:

GRANT pg_monitor TO pganalyze;

This seems to be sufficient. The prometheus-postgres-exporter collects similar metrics and provides similar instructions, and states partway through:

Run following command if you use PostgreSQL versions >= 10

GRANT pg_monitor to postgres_exporter;

The documentation for predefined roles in PostgreSQL 14 states:

role allowed access
pg_read_all_settings Read all configuration variables, even those normally visible only to superusers.
pg_read_all_stats Read all pg_stat_* views and use various statistics related extensions, even those normally visible only to superusers.
pg_stat_scan_tables Execute monitoring functions that may take ACCESS SHARE locks on tables, potentially for a long time.
pg_monitor Read/execute various monitoring views and functions. This role is a member of pg_read_all_settings, pg_read_all_stats and pg_stat_scan_tables.

Thus, it seems pg_monitor may be sufficient for the collector's needs? I gave this a try and pganalyze-collector --dry-run worked fine, including showing queries belonging to other users in the system.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions