Stephen Frost <sfr...@snowman.net> writes: > ... Tom's suggestion > would work, of course, but it would mean having to create event triggers > for all the roles in the system, and would those roles who own those > event triggers be able to disable them..?
Uh, why not? If you own the trigger, you can drop it, so why shouldn't you be able to temporarily disable it? > If so, it would almost > certainly be against the point of an auditing event trigger.. If you want auditing capability, you make an auditor role that is a member of every other role, and then it owns the trigger. (If you need to audit superuser actions too, then the auditor has to be a superuser itself, but that's no worse than before; and I'd argue that non-superusers shouldn't be able to audit superusers anyway.) regards, tom lane