v2026.1 STS Stable release with standard-term support v2025.2 LTS Stable release with long-term support v2025.1 STS Stable release with standard-term support v2024.2 LTS Stable release with long-term support Unsupported versions

Export logs

Export YSQL query and audit logs to third-party tools

Export YSQL database logs to third-party tools for security monitoring, to build operations and health dashboards, troubleshooting, and more. You can export the following types of logs:

Prerequisites

  • To export logs from Kubernetes universes, install the OpenTelemetry Operator.

  • Create an export configuration. A configuration defines the sign in credentials and settings for the tool that you want to export your logs to. Refer to Manage export configurations.

  • If you want to set pgaudit.log_level to a severity level greater than WARNING (that is, DEBUG1-5, INFO, NOTICE), you must set the YB-TServer ysql_log_min_messages flag accordingly.

Limitations

Only YSQL query and audit logs can be exported, not YCQL.

Best practices

  • Configuring logging restarts your universe. Configure logging when the cluster isn't experiencing heavy traffic.
  • Configuring logging blocks other universe operations, such as backups and maintenance. Avoid changing your settings before maintenance windows and during scheduled backups. The operation will block a backup from running.
  • To limit performance impact and control costs, log and export only what you need. The default settings are based on best practices from open source PostgreSQL, the broader community, and YugabyteDB testing to ensure the impact is bounded and insignificant.

Database query logging

New UI To enable database query logging for a universe, navigate to the universe and do the following:

  1. Click Settings > Logs and under Troubleshooting Logs click Enable Query Logging.

  2. Configure the log settings. See Query logging settings.

  3. Click Enable Database Query Logging when you are done.

YugabyteDB Anywhere begins the rolling restart.

To send query logs to a third-party tool, click Settings > Telemetry Export, click Export Database Query Log, and select the export configuration for the tool you want to export to. If query logging is not yet enabled, Telemetry Export shows Enable Database Query Log instead, and takes you to the Logs tab.

Query logging settings

Database query logging provides access to the following subset of the standard PostgreSQL logging settings.

Log SQL statements (log_statement)

Turn this option on to log SQL statements by type. You can choose the following options:

  • ddl - log data definition statements CREATE, ALTER, and DROP.
  • mod - in addition to ddl statements, log data-modifying statements INSERT, UPDATE, DELETE, TRUNCATE, and COPY FROM.
  • all - log all statements.

Statements that fail before the execute phase, or that have syntax errors, are not included; to log error statements, use Log statements with severity.

Note that if this option is off, statements may still be logged, depending on the other logging settings.

Log statements with severity (log_min_error_statement)

Controls which SQL statements that cause an error condition are logged. The current SQL statement is included in the log entry for any message of the specified severity or higher. This setting is not configurable in YugabyteDB Anywhere; it is set to ERROR, which means statements causing errors, log messages, fatal errors, or panics are logged.

Log errors with verbosity (log_error_verbosity)

Set the amount of detail for each log statement. Valid values are TERSE, DEFAULT, and VERBOSE, each adding more fields to displayed messages. TERSE excludes the logging of DETAIL, HINT, QUERY, and CONTEXT error information. VERBOSE output includes the SQLSTATE error code and the source code file name, function name, and line number that generated the error.

Log the duration of all completed statements (log_duration)

Log the duration of all completed statements. Statement text is not included. Use this option with the following option to log all durations, and the statement text for statements exceeding a specified duration. Use this option for performance analysis.

Log all statements with duration (log_min_duration_statement)

Log the duration and statement text of all statements that ran for the specified duration (in ms) or longer. Use this setting to identify slow queries. If a statement has been logged for Log SQL statements, the text is not repeated in the duration log message.

Setting this option to 0 logs all statements, with their duration, which is not recommended unless you have low traffic. You should set this to a reasonable value for your application (for example, 1000 milliseconds).

Log the execution plan (debug_print_plan)

Log the debug-level execution plan used by the parser. Used for debugging. Not recommended for production.

Log connections (log_connections)

Log all connection attempts, along with successfully completed client authentication and authorization.

Log session terminations (log_disconnections)

Log session termination and duration of the session.

Database audit logging

Note that YugabyteDB v2025.1 and later are based on PostgreSQL 15 and use pgaudit v1.7.0; earlier versions are based on PostgreSQL 11 and use pgaudit v1.3.2.

New UI To enable database audit logging for a universe, navigate to the universe and do the following:

  1. Click Settings > Logs and under Compliance Logs click Enable Audit Logging.

  2. Configure the log settings. See YSQL audit log settings.

  3. Click Enable Database Audit Logging when you are done.

YugabyteDB Anywhere begins the rolling restart.

To send audit logs to a third-party tool, click Settings > Telemetry Export, click Export Database Audit Log, and select the export configuration for the tool you want to export to.

Classic UI To enable database audit logging for a universe, navigate to the universe and do the following:

  1. On the Logs tab, click Enable Database Audit Logging.

  2. Configure the log settings. See YSQL audit log settings.

  3. Select the export configuration for the tool you want to export to.

  4. Click Enable when you are done.

YugabyteDB Anywhere begins the rolling restart.

YSQL audit log settings

You can log the following the YSQL statements:

  • Read - SELECT and COPY when the source is a relation or a query.
  • Write - INSERT, UPDATE, DELETE, TRUNCATE, and COPY when the destination is a relation.
  • Function - Function calls and DO blocks.
  • Role - Statements related to roles and privileges: GRANT, REVOKE, and CREATE/ALTER/DROP ROLE.
  • DDL - All DDL that is not included in the ROLE class.
  • Misc - Miscellaneous commands, such as DISCARD, FETCH, CHECKPOINT, VACUUM, and SET.

The YSQL audit logging settings are derived from the settings for logging used by the pgaudit extension.

Option Description Default
pgaudit.log_catalog Log statements for the PostgreSQL system catalog relations in pg_catalog. These system catalog tables record system (as opposed to user) activity, such as metadata lookups and from third-party tools performing lookups.
These statements aren't required for typical auditing and you can disable this option to reduce noise in the log.		 ON
pgaudit.log_client Enable this option to echo log messages directly to clients such as ysqlsh and psql. Log messages are printed directly to the shell, which can be helpful for debugging.
When enabled, you can set the level of logs that are output using pgaudit.log_level.		 OFF
pgaudit.log_level Sets the severity level of logs written to clients when pgaudit.log_client is on. Use this setting for debugging and testing.
Values: DEBUG1 .. DEBUG5, INFO, NOTICE, WARNING, LOG.
ERROR, FATAL, and PANIC are not allowed.
pgaudit.log_level only applies when pgaudit.log_client is on; otherwise the default LOG level is used.		 LOG
pgaudit.log_parameter Include the parameters that were passed with the statement in the logs. When parameters are present, they are included in CSV format after the statement text. OFF
pgaudit.log_relation Create separate log entries for each relation (TABLE, VIEW, and so on) referenced in a SELECT or DML statement. This is a shortcut for exhaustive logging without using object audit logging. OFF
pgaudit.log_statement_once Ordinarily, statement text (and, if enabled, parameters) are included with every log entry. Enable this setting to only include statement text and parameters for the first entry for a statement or sub-statement combination. This makes for less verbose logging, but can make it more difficult to determine the statement that generated a log entry. OFF
EA Audit log retention (days) Number of days to retain audit logs on each universe node. Audit log entries are extracted from the database logs and archived separately on the node, so they can be retained longer than the regular database logs. Use this option to satisfy compliance requirements without having to export audit logs to an external system.
Leave blank or set to 0 to disable dedicated audit log retention; audit logs are then purged along with the regular database logs.
Available in YugabyteDB Anywhere v2026.1.1 and later.		 0 (disabled)

Learn more