diff --git a/CN/modules/ROOT/nav.adoc b/CN/modules/ROOT/nav.adoc index 5b4f3bc..0a14876 100644 --- a/CN/modules/ROOT/nav.adoc +++ b/CN/modules/ROOT/nav.adoc @@ -20,6 +20,8 @@ *** xref:master/5.5.adoc[pgsql-http] *** xref:master/5.6.adoc[plpgsql_check] *** xref:master/5.7.adoc[pgroonga] +*** xref:master/5.8.adoc[pgaudit] +*** xref:master/5.9.adoc[pgrouting] ** IvorySQL架构设计 *** 查询处理 **** xref:master/6.1.1.adoc[双parser] diff --git a/CN/modules/ROOT/pages/master/5.0.adoc b/CN/modules/ROOT/pages/master/5.0.adoc index e687818..5ce2ea1 100644 --- a/CN/modules/ROOT/pages/master/5.0.adoc +++ b/CN/modules/ROOT/pages/master/5.0.adoc @@ -18,8 +18,10 @@ IvorySQL 作为一款兼容 Oracle 且基于 PostgreSQL 的高级开源数据库 | xref:master/5.5.adoc[pgsql-http]​ | 1.7.0 | 允许在SQL中发起HTTP请求，与外部Web服务进行交互 | 数据采集、API集成、微服务调用 | xref:master/5.6.adoc[plpgsql_check] | 2.8 | 提供PL/pgSQL代码的静态分析功能，可在开发阶段发现潜在错误 | 存储过程开发、代码质量检查、调试优化 | xref:master/5.7.adoc[pgroonga] | 4.0.4 | 提供​非英语语言全文搜索功能，满足高性能应用的需求 | 中日韩等语言的全文搜索功能 +| xref:master/5.8.adoc[pgaudit] | 18.0 | 提供细粒度的审计功能，记录数据库操作日志，便于安全审计和合规性检查 | 数据库安全审计、合规性检查、审计报告生成 +| xref:master/5.9.adoc[pgrouting] | 3.8.0 | 提供地理空间数据的路由计算功能，支持多种算法和数据格式 | 地理空间分析、路径规划、物流优化 |==== 这些插件均经过 IvorySQL 团队的测试和适配，确保在 IvorySQL 环境下稳定运行。用户可以根据业务需求选择合适的插件，进一步提升数据库系统的能力和灵活性。 -我们也将持续扩展和丰富 IvorySQL 的插件生态，欢迎社区开发者提交新的插件适配建议或代码贡献。如需了解更多每个插件的详细使用方法和最新兼容版本，请参阅各插件对应的文档章节。 \ No newline at end of file +我们也将持续扩展和丰富 IvorySQL 的插件生态，欢迎社区开发者提交新的插件适配建议或代码贡献。如需了解更多每个插件的详细使用方法和最新兼容版本，请参阅各插件对应的文档章节。 diff --git a/CN/modules/ROOT/pages/master/5.8.adoc b/CN/modules/ROOT/pages/master/5.8.adoc new file mode 100644 index 0000000..2a09d92 --- /dev/null +++ b/CN/modules/ROOT/pages/master/5.8.adoc @@ -0,0 +1,107 @@ + +:sectnums: +:sectnumlevels: 5 + += PgAudit + +== 概述 + +PgAudit 是一个审计扩展，可以为 DDL、DML、DCL 等关键操作生成可追溯的日志记录。通过审计日志，数据库管理员能够满足合规要求、及时发现异常行为，并在出现问题时快速定位责任主体与影响范围。 + +== 功能特点 + +* *全面审计能力*：记录 `SELECT`、`INSERT`、`UPDATE`、`DELETE`、DDL 命令以及权限变更等操作，帮助构建完整的操作轨迹。 +* *灵活的审计维度*：支持全局审计、角色审计与对象审计，可按用户、角色、模式或具体操作类型进行精细化配置。 +* *平滑集成*：复用 PostgreSQL 标准日志子系统，可与 `syslog`、`logrotate` 等工具联动，兼容现有日志采集与分析方案。 +* *合规支撑*：提供结构化审计日志，便于生成符合金融、政企等行业规范的审计报告。 +* *安全增强*：通过记录和分析数据库活动，及时发现未授权访问、异常 DML 或潜在数据泄露风险。 +* *运维优化*：辅助回放操作行为、定位性能瓶颈，支撑 SQL 优化与问题排查。 + +== 安装部署 + +=== 环境准备 + +* 已安装的 IvorySQL 数据库。 +* 编译工具链：`gcc`、`make`、`tar` 等。 +* 数据库管理员权限，用于修改 `ivorysql.conf` 并重启数据库实例。 + +=== 编译安装 PgAudit + +以 PgAudit 18.0 为例： + +[source,shell] +---- +wget https://github.com/pgaudit/pgaudit/archive/refs/tags/18.0.tar.gz +tar -xf 18.0.tar.gz +cd pgaudit-18.0 +make install USE_PGXS=1 PG_CONFIG=$PGHOME/bin/pg_config +---- + +上述命令依赖环境变量 `PGHOME` 指向安装好的 IvorySQL 主目录。安装成功后，`pgaudit.so` 会被放置到 IvorySQL 的扩展目录中。 + +=== 注册扩展前的基础配置 + +修改 `ivorysql.conf`，启用插件并设置常用参数： +---- +shared_preload_libraries = 'pgaudit' # 需实例重启生效 +pgaudit.log = 'read, write, ddl' # 审计范围示例，可按需调整 +---- + +重启数据库实例，使共享库配置生效。 + +=== 创建扩展并验证 + +[source,sql] +---- +CREATE EXTENSION IF NOT EXISTS pgaudit; +SELECT name, + default_version, + installed_version, + comment + FROM pg_available_extensions + WHERE name = 'pgaudit'; +---- + +若返回的 `installed_version` 与期望版本一致，说明扩展安装成功。 + +== 使用 + +执行如下sql示例： + +[source,sql] +---- +CREATE TABLE audit_demo(id serial PRIMARY KEY, info text); +INSERT INTO audit_demo(info) VALUES ('pgaudit test'); +SELECT * FROM audit_demo; +UPDATE audit_demo SET info = 'pgaudit update' WHERE id = 1; +DELETE FROM audit_demo WHERE id = 1; +---- + +在数据库服务器上查看审计日志： + +[source,shell] +---- +tail -f $PGDATA/log/*.log | grep 'AUDIT:' +---- + +[source,text] +---- +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,CREATE SEQUENCE,SEQUENCE,public.audit_demo_id_seq,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)", +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,CREATE TABLE,TABLE,public.audit_demo,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)", +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,CREATE INDEX,INDEX,public.audit_demo_pkey,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)", +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,ALTER SEQUENCE,SEQUENCE,public.audit_demo_id_seq,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)", +2025-10-31 15:56:32.117 CST [11451] LOG: AUDIT: SESSION,2,1,WRITE,INSERT,,,INSERT INTO audit_demo(info) VALUES ('pgaudit test'), +2025-10-31 15:56:32.121 CST [11451] LOG: AUDIT: SESSION,3,1,READ,SELECT,,,SELECT * FROM audit_demo, +2025-10-31 15:56:32.122 CST [11451] LOG: AUDIT: SESSION,4,1,WRITE,UPDATE,,,UPDATE audit_demo SET info = 'pgaudit update' WHERE id = 1, +2025-10-31 15:56:32.127 CST [11451] LOG: AUDIT: SESSION,5,1,WRITE,DELETE,,,DELETE FROM audit_demo WHERE id = 1, +---- + +若想记录参数的值，打开`pgaudit.log_parameter = 'on'`，效果如下： +[source,text] +---- +ivorysql=# SHOW pgaudit.log_parameter; +pgaudit.log_parameter +----------------------- +on +(1 row) +---- diff --git a/CN/modules/ROOT/pages/master/5.9.adoc b/CN/modules/ROOT/pages/master/5.9.adoc new file mode 100644 index 0000000..9ef7989 --- /dev/null +++ b/CN/modules/ROOT/pages/master/5.9.adoc @@ -0,0 +1,57 @@ + +:sectnums: +:sectnumlevels: 5 + += pgRouting + +== 概述 +pgRouting 是一个基于 PostgreSQL/PostGIS 数据库构建的开源地理空间路由扩展库。它为数据库赋予了强大的网络分析功能，使其能够处理复杂的路径规划与图论计算问题，例如计算两点之间的最短路径、执行旅行推销员（TSP）分析或计算服务区范围等。它将路由算法直接嵌入到数据库中，从而避免了在应用层进行复杂的数据传输与计算。 + +该扩展的核心优势在于能够利用 PostgreSQL 强大的数据管理能力和 PostGIS 丰富的空间函数，直接在数据库内部对空间网络数据执行高效计算。这不仅简化了应用程序的开发流程，还通过减少数据移动大幅提升了大规模网络分析的性能。 + +pgRouting 广泛应用于物流配送、交通导航、网络分析、城市规划及供应链管理等多个领域。其开源特性吸引了全球开发者持续的贡献与完善，使其成为空间数据库领域进行路径分析和网络求解的首选工具之一。 + +== 安装 + +[TIP] +环境中已经安装了IvorySQL5.0及以上版本，安装路径为/usr/local/ivorysql/ivorysql-5 + +=== 源码安装 + +** 安装依赖 + +对perl有依赖，perl一般在装IvorySQL时已经装上了，这里不用再装。 +CMake版本要求 >= 3.12, Boost版本 >= 1.56 +``` +#安装依赖 +sudo apt install cmake libboost-all-dev +``` + +** 编译安装 +``` +wget https://github.com/pgRouting/pgrouting/releases/download/v3.8.0/pgrouting-3.8.0.tar.gz +tar xvf pgrouting-3.8.0.tar.gz +cd pgrouting-3.8.0 +mkdir build +cd build +cmake .. -DPOSTGRESQL_PG_CONFIG=/path/to/pg_config # eg: /usr/local/ivorysql/ivorysql-5/bin/pg_config +make +sudo make install +``` + +== 创建Extension并确认ddlx版本 + +psql 连接到数据库，执行如下命令： +``` +ivorysql=# CREATE extension pgrouting; +CREATE EXTENSION + +ivorysql=# SELECT * FROM pg_available_extensions WHERE name = 'pgrouting'; + name | default_version | installed_version | comment +-----------+-----------------+-------------------+--------------------- + pgrouting | 3.8.0 | | pgRouting Extension +(1 row) +``` + +== 使用 +关于pgRouting的使用，请参阅 https://docs.pgrouting.org/[pgRouting官方文档] diff --git a/EN/modules/ROOT/nav.adoc b/EN/modules/ROOT/nav.adoc index 66184aa..97b309c 100644 --- a/EN/modules/ROOT/nav.adoc +++ b/EN/modules/ROOT/nav.adoc @@ -12,13 +12,15 @@ ** xref:master/4.4.adoc[Operation Management] ** xref:master/4.5.adoc[Migration] * IvorySQL Ecosystem -** xref:master/5.0.adoc[Overview] +** xref:master/5.0.adoc[Overview] ** xref:master/5.2.adoc[pgvector] ** xref:master/5.3.adoc[pgddl(DDL Extractor)] ** xref:master/5.4.adoc[pg_cron] ** xref:master/5.5.adoc[pgsql-http] ** xref:master/5.6.adoc[plpgsql_check] ** xref:master/5.7.adoc[pgroonga] +** xref:master/5.8.adoc[pgaudit] +** xref:master/5.9.adoc[pgrouting] * IvorySQL Architecture Design ** Query Processing *** xref:master/6.1.1.adoc[Dual Parser] diff --git a/EN/modules/ROOT/pages/master/5.8.adoc b/EN/modules/ROOT/pages/master/5.8.adoc new file mode 100644 index 0000000..bb35912 --- /dev/null +++ b/EN/modules/ROOT/pages/master/5.8.adoc @@ -0,0 +1,107 @@ +:sectnums: +:sectnumlevels: 5 + += PgAudit + +== Overview + +PgAudit is an auditing extension for IvorySQL that produces traceable log records for critical operations such as DDL, DML, and DCL. With the audit trail, database administrators can meet compliance requirements, quickly detect abnormal behavior, and identify accountability and impact scope when incidents occur. + +== Key Features + +* *Comprehensive auditing*: Captures `SELECT`, `INSERT`, `UPDATE`, `DELETE`, DDL commands, privilege changes, and more to build a complete activity timeline. +* *Flexible scope control*: Supports global, role-based, and object-level auditing, allowing fine-grained configuration by user, role, schema, or operation type. +* *Seamless integration*: Reuses PostgreSQL's standard logging subsystem and works with tools like `syslog` and `logrotate`, aligning with existing log ingestion and analysis pipelines. +* *Compliance ready*: Generates structured audit logs suitable for meeting regulatory requirements in finance, government, and other regulated industries. +* *Security enhancement*: Records and inspects database activity to surface unauthorized access, anomalous DML, or potential data leakage risks in time. +* *Operations insight*: Helps replay operational actions, locate performance bottlenecks, and support SQL tuning and incident troubleshooting. + +== Installation and Deployment + +=== Prerequisites + +* A IvorySQL installation (recommended version aligned with the targeted PgAudit release). +* Build toolchain: `gcc`, `make`, `tar`, etc. +* Database superuser privileges to modify `ivorysql.conf` and restart the instance. + +=== Compile and Install PgAudit + +Taking PgAudit 18.0 as an example: + +[source,shell] +---- +wget https://github.com/pgaudit/pgaudit/archive/refs/tags/18.0.tar.gz +tar -xf 18.0.tar.gz +cd pgaudit-18.0 +make install USE_PGXS=1 PG_CONFIG=$PGHOME/bin/pg_config +---- + +The commands above expect the environment variable `PGHOME` to point to the installed IvorySQL home directory. After installation, `pgaudit.so` will be placed in IvorySQL's extension directory. + +=== Baseline Configuration Before Registering the Extension + +1. Modify `ivorysql.conf` to load the plugin and configure common parameters: + ---- + shared_preload_libraries = 'pgaudit' # Requires an instance restart + pgaudit.log = 'read, write, ddl' # Sample audit scope; adjust as needed + ---- + +2. Restart or reload the database instance so the shared library configuration takes effect. + +=== Create the Extension and Verify + +[source,sql] +---- +CREATE EXTENSION IF NOT EXISTS pgaudit; +SELECT name, + default_version, + installed_version, + comment + FROM pg_available_extensions + WHERE name = 'pgaudit'; +---- + +If the returned `installed_version` matches the expected release, the extension has been installed successfully. + +== Usage + +Execute the following SQL sample: + + [source,sql] + ---- + CREATE TABLE audit_demo(id serial PRIMARY KEY, info text); + INSERT INTO audit_demo(info) VALUES ('pgaudit test'); + SELECT * FROM audit_demo; + UPDATE audit_demo SET info = 'pgaudit update' WHERE id = 1; + DELETE FROM audit_demo WHERE id = 1; + ---- + +Check the audit logs on the database server: + +[source,shell] +---- +tail -f $PGDATA/log/*.log | grep 'AUDIT:' +---- + +[source,text] +---- +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,CREATE SEQUENCE,SEQUENCE,public.audit_demo_id_seq,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)", +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,CREATE TABLE,TABLE,public.audit_demo,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)", +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,CREATE INDEX,INDEX,public.audit_demo_pkey,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)", +2025-10-31 15:56:32.113 CST [11451] LOG: AUDIT: SESSION,1,1,DDL,ALTER SEQUENCE,SEQUENCE,public.audit_demo_id_seq,"CREATE TABLE audit_demo(id serial PRIMARY KEY, info text)", +2025-10-31 15:56:32.117 CST [11451] LOG: AUDIT: SESSION,2,1,WRITE,INSERT,,,INSERT INTO audit_demo(info) VALUES ('pgaudit test'), +2025-10-31 15:56:32.121 CST [11451] LOG: AUDIT: SESSION,3,1,READ,SELECT,,,SELECT * FROM audit_demo, +2025-10-31 15:56:32.122 CST [11451] LOG: AUDIT: SESSION,4,1,WRITE,UPDATE,,,UPDATE audit_demo SET info = 'pgaudit update' WHERE id = 1, +2025-10-31 15:56:32.127 CST [11451] LOG: AUDIT: SESSION,5,1,WRITE,DELETE,,,DELETE FROM audit_demo WHERE id = 1, +---- + +To record parameter values as well, enable `pgaudit.log_parameter = 'on'`: + +[source,text] +---- +ivorysql=# SHOW pgaudit.log_parameter; +pgaudit.log_parameter +----------------------- +on +(1 row) +---- diff --git a/EN/modules/ROOT/pages/master/5.9.adoc b/EN/modules/ROOT/pages/master/5.9.adoc new file mode 100644 index 0000000..6235290 --- /dev/null +++ b/EN/modules/ROOT/pages/master/5.9.adoc @@ -0,0 +1,56 @@ +:sectnums: +:sectnumlevels: 5 + += pgRouting + +== Overview +pgRouting is an open-source geospatial routing extension library built on PostgreSQL/PostGIS databases. It endows databases with powerful network analysis capabilities, enabling them to handle complex path planning and graph theory computation problems, such as calculating the shortest path between two points, performing Traveling Salesman Problem (TSP) analysis, or computing service area coverage. It embeds routing algorithms directly into the database, thereby avoiding complex data transfer and computation at the application layer. + +The core advantage of this extension lies in its ability to leverage PostgreSQL's powerful data management capabilities and PostGIS's rich spatial functions to perform efficient computation on spatial network data directly within the database. This not only simplifies application development processes but also significantly improves the performance of large-scale network analysis by reducing data movement. + +pgRouting is widely used in logistics and distribution, traffic navigation, network analysis, urban planning, and supply chain management, among other fields. Its open-source nature has attracted continuous contributions and improvements from developers worldwide, making it one of the preferred tools for path analysis and network solving in the spatial database domain. + +== Installation + +[TIP] +IvorySQL 5.0 or higher version is already installed in the environment, with the installation path at /usr/local/ivorysql/ivorysql-5 + +=== Source Installation + +** Install dependencies + +It depends on perl, which is generally already installed when installing IvorySQL, so no need to install it here. +CMake version requirement >= 3.12, Boost version >= 1.56 +``` +# Install dependencies +sudo apt install cmake libboost-all-dev +``` + +** Compile and install +``` +wget https://github.com/pgRouting/pgrouting/releases/download/v3.8.0/pgrouting-3.8.0.tar.gz +tar xvf pgrouting-3.8.0.tar.gz +cd pgrouting-3.8.0 +mkdir build +cd build +cmake .. -DPOSTGRESQL_PG_CONFIG=/path/to/pg_config # eg: /usr/local/ivorysql/ivorysql-5/bin/pg_config +make +sudo make install +``` + +== Create Extension and Confirm pgRouting Version + +Connect to the database with psql and execute the following commands: +``` +ivorysql=# CREATE extension pgrouting; +CREATE EXTENSION + +ivorysql=# SELECT * FROM pg_available_extensions WHERE name = 'pgrouting'; + name | default_version | installed_version | comment +-----------+-----------------+-------------------+--------------------- + pgrouting | 3.8.0 | | pgRouting Extension +(1 row) +``` + +== Usage +For pgRouting usage, please refer to the https://docs.pgrouting.org/[pgRouting Official Documentation]