# Ensure query/audit logging is enabled for the database

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103904942449-ensure-queryaudit-logging-is-enabled-for-the-database
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure database audit logging is enabled using the PGAudit extension, so that important database activity, such as changes to tables, roles, and permissions, is recorded in the Postgres logs. The logged events should cover the activity required by the organization's security and compliance policies.

**Rationale**

Without audit logging, there is no reliable record of who changed data, schemas, or permissions in the database. This makes it hard to detect misuse, investigate incidents, or prove compliance. PGAudit adds detailed, structured audit entries to the Postgres logs, which can be reviewed in the dashboard or sent to an external system using log drains.

**Impact**

-   Records database changes for investigations and audits
    
-   Helps detect suspicious database activity
    
-   Very detailed logging can increase log volume
    

**Default Value**

By default, the PGAudit extension is not enabled and pgaudit.log is set to none.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   A decision on which activity must be logged
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open the SQL Editor in the sidebar.
    
4.  Run: select \* from pg\_extension where extname = 'pgaudit';
    
5.  Run: select rolname, rolconfig from pg\_roles where rolname = 'postgres'; and check for a pgaudit.log setting.
    
6.  If PGAudit is not enabled or no logging is set, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Database in the sidebar and select Extensions.
    
4.  Search for pgaudit and enable it.
    
5.  Open the SQL Editor and run: alter role postgres set pgaudit.log to 'ddl, role, write';
    
6.  Perform a fast database reboot if the setting does not take effect.
    
7.  Open Logs, select Postgres Logs, and confirm that audit entries appear.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open the SQL Editor in the sidebar.
    
4.  Run: alter role postgres set pgaudit.log to 'none';
    
5.  Optionally disable the pgaudit extension under Database > Extensions.
    

**Reference**

-   [https://supabase.com/docs/guides/database/extensions/pgaudit](https://supabase.com/docs/guides/database/extensions/pgaudit)
    
-   [https://supabase.com/docs/guides/telemetry/logs](https://supabase.com/docs/guides/telemetry/logs)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.