← Back to Forum

Opengard captures queries no one did

Hello,
I'm testing Opengard and set a policy to capture all events using the first time setup wizard. After few seconds I'm starting to see really long queries that I know for a fact are not real, as this is a testing database no one but myself have access to.

For example, I see queries like these:

SELECT version();


SELECT ns.nspname, t.oid, t.typname, t.typtype, t.typnotnull, t.elemtypoid
FROM (
-- Arrays have typtype=b - this subquery identifies them by their typreceive and converts their typtype to a
-- We first do this for the type (innerest-most subquery), and then for its element type
-- This also returns the array element, range subtype and domain base type as elemtypoid
SELECT
typ.oid, typ.typnamespace, typ.typname, typ.typtype, typ.typrelid, typ.typnotnull, typ.relkind,
elemtyp.oid AS elemtypoid, elemtyp.typname AS elemtypname, elemcls.relkind AS elemrelkind,
CASE WHEN elemproc.proname='array_recv' THEN 'a' ELSE elemtyp.typtype END AS elemtyptype
, typ.typcategory
FROM (
SELECT typ.oid, typnamespace, typname, typrelid, typnotnull, relkind, typelem AS elemoid,
CASE WHEN proc.proname='array_recv' THEN 'a' ELSE typ.typtype END AS typtype,
CASE
WHEN proc.proname='array_recv' THEN typ.typelem
WHEN typ.typtype='r' THEN rngsubtype
WHEN typ.typtype='m' THEN (SELECT rngtypid FROM pg_range WHERE rngmultitypid = typ.oid)
WHEN typ.typtype='d' THEN typ.typbasetype
END AS elemtypoid
, typ.typcategory
FROM pg_type AS typ
LEFT JOIN pg_class AS cls ON (cls.oid = typ.typrelid)
LEFT JOIN pg_proc AS proc ON proc.oid = typ.typreceive
LEFT JOIN pg_range ON (pg_range.rngtypid = typ.oid)
) AS typ
LEFT JOIN pg_type AS elemtyp ON elemtyp.oid = elemtypoid
LEFT JOIN pg_class AS elemcls ON (elemcls.oid = elemtyp.typrelid)
LEFT JOIN pg_proc AS elemproc ON elemproc.oid = elemtyp.typreceive
) AS t
JOIN pg_namespace AS ns ON (ns.oid = typnamespace)
WHERE

(typtype IN ('b', 'r', 'm', 'e', 'd') OR -- Base, range, multirange, enum, domain
(typtype = 'c' AND relkind='c') OR -- User-defined free-standing composites (not table composites) by default
(typtype = 'p' AND typname IN ('record', 'void', 'unknown')) OR -- Some special supported pseudo-types
(typtype = 'a' AND ( -- Array of...
elemtyptype IN ('b', 'r', 'm', 'e', 'd') OR -- Array of base, range, multirange, enum, domain
(elemtyptype = 'p' AND elemtypname IN ('record', 'void')) OR -- Arrays of special supported pseudo-types
(elemtyptype = 'c' AND elemrelkind='c') -- Array of user-defined free-standing composites (not table composites) by default
)))
ORDER BY CASE
WHEN typtype IN ('b', 'e', 'p') THEN 0 -- First base types, enums, pseudo-types
WHEN typtype = 'c' THEN 1 -- Composites after (fields loaded later in 2nd pass)
WHEN typtype = 'r' THEN 2 -- Ranges after
WHEN typtype = 'm' THEN 3 -- Multiranges after
WHEN typtype = 'd' AND elemtyptype <> 'a' THEN 4 -- Domains over non-arrays after
WHEN typtype = 'a' THEN 5 -- Arrays after
WHEN typtype = 'd' AND elemtyptype = 'a' THEN 6 -- Domains over arrays last
END;


-- Load field definitions for (free-standing) composite types
SELECT typ.oid, att.attname, att.atttypid
FROM pg_type AS typ
JOIN pg_namespace AS ns ON (ns.oid = typ.typnamespace)
JOIN pg_class AS cls ON (cls.oid = typ.typrelid)
JOIN pg_attribute AS att ON (att.attrelid = typ.typrelid)
WHERE
(typ.typtype = 'c' AND cls.relkind='c') AND

attnum > 0 AND -- Don't load system attributes
NOT attisdropped
ORDER BY typ.oid, att.attnum;


-- Load enum fields
SELECT typ.oid, enumlabel
FROM pg_enum
JOIN pg_type AS typ ON typ.oid = enumtypid
JOIN pg_namespace AS ns ON ns.oid = typ.typnamespace

ORDER BY oid, enumsortorder;




And I also see login and logouts I did not do.
Can you please explain this?
0

3 Replies

Hi Yusuf,

The queries you're seeing are generated by OpenGard itself. When collecting audit data, it performs the following actions:

- Logs in to the database using the credentials you provided.
- If automatic audit setup is enabled, it checks the database version and configures the required audit policies.
- Each time it retrieves data, it reads from the audit trail.

Because of this process, some internal queries may appear in the logs—especially if you have a policy configured to capture all events.

If you want to avoid this kind of noise, we recommend creating a dedicated OpenGard user with limited privileges and configuring your audit policies to exclude activity from this user.

Thanks,
OG Team
0
Hello,

I don't know how to do what you're suggesting, can you help me setup a policy?

Thanks
0
Hi Yusuf,

You need to open the predicates of the policy that captures all events (click the small blue button with the funnel icon) and enable the **Username** filter. Then select the **NotEqual** operation and enter the username you assigned to OpenGard for database access.

This will filter out any queries generated by this user.

If you need further assistance, please reach out to us via the support email.

Thanks,
OG Team
0