What will happen to my slow query alert with audit logs for DB enabled?

Hey Daniel,

 Turning on log_statement=mod won't stop your slow-query alarm from working, but it can throw off your count, so let me explain both parts.

 Will the "duration" lines still show up?

 Yes. The "duration" text only comes from log_min_duration_statement, log_statement never emits it. Even when a statement gets caught by both settings, Postgres still writes the duration line in one log and doesn't repeat the query text. From the Postgres docs: "the text of statements that are logged because of log_statement will not be repeated in the duration log message."

 So a slow UPDATE gives you two lines, and your duration count is unaffected:

 LOG: statement: UPDATE accounts SET ... ;  <- from log_statement=mod
 LOG: duration: 312.456 ms          <- from log_min_duration_statement

 So what's the catch?

 False positives. Today your log group only has "duration" lines. Once log_statement=mod is on, the full SQL text of every INSERT/UPDATE/DELETE/DDL lands there too. If any of that SQL contains the word "duration" (a column, value, or comment like INSERT INTO calls (duration) ...), your metric filter will match it and inflate the alarm.

 The fix: change your metric filter from "duration" to "duration:" (with the colon, quoted). That matches the slow-query line format but ignores SQL that just happens to mention the word. On top, this doesn't require reboot since log_statement is a dynamic parameter.

 Can you send the audit logs to a separate log file/group?

Not natively, unfortunately. Unlike MySQL/MariaDB (which get separate slowquery/audit groups), RDS for PostgreSQL writes everything — errors, slow queries, log_statement, even pgAudit, into the single group /aws/rds/instance/<my_instance>/postgresql. There's no option to split it out.

 Your options if you want them separated:

1. Just filter by pattern (easiest): "duration:" for slow queries, "statement:" for audit. Two alarms, one log group.
2. Use pgAudit instead of log_statement: it prefixes every line with AUDIT:, so it's trivially separable (needs shared_preload_libraries + one reboot).
3. Fan out downstream: put a CloudWatch Logs subscription filter on the group → Lambda/Firehose and route the two line types to different destinations. That's the only way to get them into physically separate groups.

 Hope that helps!