Open
Description
It looks like the pg_monitor
predefined role is sufficient for pganalyze-collector, so granting access should be as simple as:
GRANT pg_monitor TO pganalyze;
This seems to be sufficient. The prometheus-postgres-exporter collects similar metrics and provides similar instructions, and states partway through:
Run following command if you use PostgreSQL versions >= 10
GRANT pg_monitor to postgres_exporter;
The documentation for predefined roles in PostgreSQL 14 states:
role | allowed access |
---|---|
pg_read_all_settings | Read all configuration variables, even those normally visible only to superusers. |
pg_read_all_stats | Read all pg_stat_* views and use various statistics related extensions, even those normally visible only to superusers. |
pg_stat_scan_tables | Execute monitoring functions that may take ACCESS SHARE locks on tables, potentially for a long time. |
pg_monitor | Read/execute various monitoring views and functions. This role is a member of pg_read_all_settings, pg_read_all_stats and pg_stat_scan_tables. |
Thus, it seems pg_monitor may be sufficient for the collector's needs? I gave this a try and pganalyze-collector --dry-run
worked fine, including showing queries belonging to other users in the system.