Trigger for audit logging in PostgreSQL

Introduction

Audit logging helps track changes in your database. A trigger automatically records these changes without manual effort.

You want to keep a history of changes to important tables.

You need to know who changed data and when.

You want to detect accidental or unauthorized data modifications.

You need to comply with data regulations requiring change tracking.

Syntax

PostgreSQL

CREATE TRIGGER trigger_name
AFTER INSERT OR UPDATE OR DELETE ON table_name
FOR EACH ROW EXECUTE FUNCTION function_name();

The trigger runs after data changes (insert, update, delete).

The function called by the trigger contains the audit logic.

Examples

This trigger logs only new rows inserted into the employees table.

PostgreSQL

CREATE TRIGGER audit_trigger
AFTER INSERT ON employees
FOR EACH ROW EXECUTE FUNCTION audit_insert();

This trigger logs updates and deletions on the employees table.

PostgreSQL

CREATE TRIGGER audit_trigger
AFTER UPDATE OR DELETE ON employees
FOR EACH ROW EXECUTE FUNCTION audit_changes();

Sample Program

This example creates an employees table and an audit table. The trigger calls a function that logs inserts, updates, and deletes with old and new names and timestamps.

After running the insert, update, and delete commands, the audit table will show the recorded changes.

PostgreSQL

CREATE TABLE employees (
  id SERIAL PRIMARY KEY,
  name TEXT NOT NULL,
  position TEXT NOT NULL
);

CREATE TABLE employees_audit (
  audit_id SERIAL PRIMARY KEY,
  employee_id INT,
  operation TEXT,
  old_name TEXT,
  new_name TEXT,
  changed_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE OR REPLACE FUNCTION audit_employees_changes() RETURNS TRIGGER AS $$
BEGIN
  IF TG_OP = 'INSERT' THEN
    INSERT INTO employees_audit(employee_id, operation, new_name)
    VALUES (NEW.id, TG_OP, NEW.name);
    RETURN NEW;
  ELSIF TG_OP = 'UPDATE' THEN
    INSERT INTO employees_audit(employee_id, operation, old_name, new_name)
    VALUES (NEW.id, TG_OP, OLD.name, NEW.name);
    RETURN NEW;
  ELSIF TG_OP = 'DELETE' THEN
    INSERT INTO employees_audit(employee_id, operation, old_name)
    VALUES (OLD.id, TG_OP, OLD.name);
    RETURN OLD;
  END IF;
  RETURN NULL;
END;
$$ LANGUAGE plpgsql;

CREATE TRIGGER audit_employees_trigger
AFTER INSERT OR UPDATE OR DELETE ON employees
FOR EACH ROW EXECUTE FUNCTION audit_employees_changes();

-- Example insert
INSERT INTO employees(name, position) VALUES ('Alice', 'Developer');

-- Example update
UPDATE employees SET name = 'Alice Smith' WHERE id = 1;

-- Example delete
DELETE FROM employees WHERE id = 1;

-- Check audit log
SELECT * FROM employees_audit;

Important Notes

Make sure the audit table has columns to store old and new values as needed.

Triggers can slow down writes slightly because they run extra code.

Use AFTER triggers to ensure the main operation succeeds before logging.

Summary

Triggers automate audit logging by running code on data changes.

Use a trigger function to insert audit records with old and new data.

This helps track who changed what and when in your database.

Practice

1. What is the main purpose of a trigger in PostgreSQL for audit logging?

easy

A. To backup the database periodically

B. To automatically record changes made to data in a table

C. To create new tables automatically

D. To speed up query execution

Solution

1. Step 1: Understand what triggers do

   Triggers run code automatically when data changes occur in a table.

2. Step 2: Connect triggers to audit logging

   Audit logging means recording who changed what and when, which triggers help automate.

3. Final Answer:

   To automatically record changes made to data in a table -> Option B

4. Quick Check:

   Trigger = automatic audit record [OK]

Hint: Triggers run code on data changes to log audits [OK]

Common Mistakes:

• Thinking triggers speed up queries
• Confusing triggers with backups
• Assuming triggers create tables

2. Which of the following is the correct syntax to create a trigger function for audit logging in PostgreSQL?

easy

A. CREATE TRIGGER audit_log BEFORE INSERT ON audit_table EXECUTE FUNCTION log_changes();

B. CREATE FUNCTION audit_log() RETURNS void AS $$ BEGIN UPDATE audit_table SET changed = TRUE; END; $$ LANGUAGE sql;

C. CREATE FUNCTION audit_log() RETURNS trigger AS $$ BEGIN INSERT INTO audit_table VALUES (OLD.*); RETURN NEW; END; $$ LANGUAGE plpgsql;

D. CREATE FUNCTION audit_log() RETURNS trigger AS $$ BEGIN INSERT INTO audit_table VALUES (NEW.*); RETURN OLD; END; $$ LANGUAGE plpgsql;

Solution

1. Step 1: Check function return type and language

   Trigger functions must return type 'trigger' and use 'plpgsql' language.

2. Step 2: Verify correct use of OLD and NEW

   For audit logging on updates/deletes, OLD.* is used to capture previous data; function returns NEW to continue operation.

3. Final Answer:

   CREATE FUNCTION audit_log() RETURNS trigger AS $$ BEGIN INSERT INTO audit_table VALUES (OLD.*); RETURN NEW; END; $$ LANGUAGE plpgsql; -> Option C

4. Quick Check:

   Trigger function syntax = CREATE FUNCTION audit_log() RETURNS trigger AS $$ BEGIN INSERT INTO audit_table VALUES (OLD.*); RETURN NEW; END; $$ LANGUAGE plpgsql; [OK]

Hint: Trigger functions return 'trigger' and use plpgsql [OK]

Common Mistakes:

• Using RETURNS void instead of RETURNS trigger
• Returning OLD instead of NEW
• Wrong language like SQL instead of plpgsql

3. Given this trigger function and trigger creation:

CREATE FUNCTION audit_func() RETURNS trigger AS $$ BEGIN INSERT INTO audit_log(user_name, action_time) VALUES (current_user, now()); RETURN NEW; END; $$ LANGUAGE plpgsql;
CREATE TRIGGER audit_trigger AFTER INSERT ON employees FOR EACH ROW EXECUTE FUNCTION audit_func();

What happens when a new row is inserted into employees?

medium

A. A new row is added to audit_log with current user and timestamp

B. The insert into employees fails with an error

C. No action occurs because the trigger is AFTER INSERT

D. The employees row is deleted immediately

Solution

1. Step 1: Understand AFTER INSERT trigger behavior

   AFTER INSERT triggers run after a new row is added, so the insert succeeds first.

2. Step 2: Analyze trigger function actions

   The function inserts a row into audit_log with current user and timestamp, logging the event.

3. Final Answer:

   A new row is added to audit_log with current user and timestamp -> Option A

4. Quick Check:

   AFTER INSERT triggers log data after insert [OK]

Hint: AFTER INSERT triggers run after data is inserted [OK]

Common Mistakes:

• Thinking AFTER INSERT prevents insert
• Assuming trigger deletes data
• Believing no action happens after insert

4. You wrote this trigger function:

CREATE FUNCTION audit_changes() RETURNS trigger AS $$ BEGIN INSERT INTO audit_log VALUES (NEW.*); RETURN NEW; END; $$ LANGUAGE plpgsql;

But when the trigger fires (e.g., on INSERT or UPDATE to the table), you get an error. What is the likely cause?

medium

A. Triggers cannot insert into tables

B. Trigger functions cannot use RETURN NEW

C. The function must be written in SQL, not plpgsql

D. The audit_log table does not match the NEW record structure

Solution

1. Step 1: Check compatibility of NEW.* with audit_log table

   NEW.* expands to all columns of the triggering table, which must match audit_log columns exactly.

2. Step 2: Identify mismatch causes error

   If audit_log has different columns or order, the insert fails when the trigger fires.

3. Final Answer:

   The audit_log table does not match the NEW record structure -> Option D

4. Quick Check:

   Column mismatch causes insert error [OK]

Hint: Ensure audit_log columns match NEW record exactly [OK]

Common Mistakes:

• Thinking RETURN NEW is invalid
• Assuming language must be SQL
• Believing triggers cannot insert data

5. You want to create an audit log that records old and new values on UPDATE for a products table. Which trigger function code correctly captures both old and new data for audit logging?

hard

A. CREATE FUNCTION audit_update() RETURNS trigger AS $$ BEGIN INSERT INTO audit_log(old_name, new_name) VALUES (OLD.name, NEW.name); RETURN NEW; END; $$ LANGUAGE plpgsql;

B. CREATE FUNCTION audit_update() RETURNS trigger AS $$ BEGIN INSERT INTO audit_log(name) VALUES (NEW.name); RETURN OLD; END; $$ LANGUAGE plpgsql;

C. CREATE FUNCTION audit_update() RETURNS trigger AS $$ BEGIN INSERT INTO audit_log(old_name, new_name) VALUES (NEW.name, OLD.name); RETURN NEW; END; $$ LANGUAGE plpgsql;

D. CREATE FUNCTION audit_update() RETURNS trigger AS $$ BEGIN UPDATE audit_log SET name = NEW.name WHERE name = OLD.name; RETURN NEW; END; $$ LANGUAGE plpgsql;

Solution

1. Step 1: Identify correct use of OLD and NEW in UPDATE triggers

   OLD contains previous row data, NEW contains updated data; audit log needs both.

2. Step 2: Check function logic and return value

   Insert old and new names correctly, then return NEW to allow update to proceed.

3. Final Answer:

   CREATE FUNCTION audit_update() RETURNS trigger AS $$ BEGIN INSERT INTO audit_log(old_name, new_name) VALUES (OLD.name, NEW.name); RETURN NEW; END; $$ LANGUAGE plpgsql; -> Option A

4. Quick Check:

   OLD before, NEW after update [OK]

Hint: Use OLD for old data, NEW for new data in audit triggers [OK]

Common Mistakes:

• Swapping OLD and NEW values
• Returning OLD instead of NEW
• Using UPDATE instead of INSERT in audit log