Fix false positive non-superuser errors

jcoleman · web-flow · commit 3942fd4f7f87 · 2022-01-26T15:38:30.000-05:00
Regex matching solely against the word "insufficient" means that it's trivial to cause this to alert unnecessarily by merely including the string "insufficient" in one's real query. Instead verify that we don't actually have a real query and know for certain this is an error condition.
diff --git a/check_postgres.pl b/check_postgres.pl
@@ -8737,7 +8737,7 @@ sub check_txn_idle {
         my $st = defined($r->{state}) ? $r->{state} : '';
 
         ## Return unknown if we cannot see because we are a non-superuser
-        if ($cq =~ /insufficient/) {
+        if ($cq eq '<insufficient privilege>') {
             add_unknown msg('psa-nosuper');
             return;
         }

Original file line number	Diff line number	Diff line change
`@@ -8737,7 +8737,7 @@ sub check_txn_idle {`
`8737`	`8737`	`my $st = defined($r->{state}) ? $r->{state} : '';`
`8738`	`8738`
`8739`	`8739`	`## Return unknown if we cannot see because we are a non-superuser`
`8740`		`- if ($cq =~ /insufficient/) {`
	`8740`	`+ if ($cq eq '<insufficient privilege>') {`
`8741`	`8741`	`add_unknown msg('psa-nosuper');`
`8742`	`8742`	`return;`
`8743`	`8743`	`}`