SQL audit

The SQL audit feature allows you to query SQL statements in the current cluster by execution user, access IP address, or operation type. You can also export the query results to enhance security auditing. This topic describes how to use SQL audit.

Considerations

SQL audit is a paid feature. Fees vary by cloud provider, region, and billing item. For more information, see SQL audit billing.

Configure storage

1. Log in to the OceanBase Cloud console.

2. In the left-side navigation pane, click Instances.

3. In the instance list, find the target instance and click its name to go to the instance workspace.

4. In the left-side navigation pane, click Diagnostics. On the Diagnostics page, select the Real-Time Diagnostics tab.

5. In the middle of the page, click the SQL Audit tab.

6. Click Modify Storage Configuration next to Storage Configuration and modify the storage configuration in the dialog box.

   • OceanBase Cloud

     Parameter	Description
     Total Storage Duration	SQL execution records can be stored for 7 to 720 days. Records older than the specified duration are deleted.
     Hot Storage Duration	Within the total storage duration, data is automatically moved to cold storage after the specified hot storage duration.

   • Custom log service

     Note

     • Only Alibaba Cloud instances support pushing SQL audit data to a custom log service.
     • Grant the following API permissions to the AccessKey ID and AccessKey Secret:
       • PostLogStoreLogs: Write logs to a Logstore.
       • GetLogStore: View Logstore metadata.

     Parameter	Description
     Project	The name of the log service project.
     Logstore	The name of the log service Logstore.
     AccessKey ID	The access ID used by the log service to identify the user.
     AccessKey Secret	The key used to encrypt a signature string and by the log service to verify the signature. Keep this key confidential.

   • Object storage

     Note

     • Only Alibaba Cloud and AWS instances support pushing SQL audit data to object storage.
     • SQL audit data is stored in the object storage bucket that you specify.

     Parameter	Description
     Bucket	The name of the object storage bucket.
     Directory	The directory in the object storage bucket. Multi-level directories are supported.
     Access Key ID	The AccessKey ID used to access object storage.
     Access Key Secret	The AccessKey Secret used to access object storage.

7. Click Modify Push Configuration to modify the storage destination and related parameters.

   Note

   After you modify the storage configuration, new audit data is pushed to the new storage destination. Data in the original storage location is not affected.

Enable SQL audit for a tenant

1. Log in to the OceanBase Cloud console.

2. In the left-side navigation pane, click Instances.

3. In the instance list, find the target instance and click its name to go to the instance workspace.

4. In the left-side navigation pane, click Diagnostics. On the Diagnostics page, select the Real-Time Diagnostics tab.

5. In the middle of the page, click the SQL Audit tab.

6. In the upper-left corner of the SQL Audit tab, select a tenant.

7. On the SQL Audit tab, click Enable.

8. Configure audit rules in the dialog box.

   Note

   • All SQL types are selected by default. This means that all types of SQL statements are recorded.
   • Audit rules can be configured only when the storage destination is object storage.
   • This feature supports only tenants in MySQL mode on clusters of OceanBase Database V4.2.5 or later.

   • MySQL

     If the storage destination is object storage, configure the following audit rules:

     Parameter	Description
     Target Database Account	Select the database accounts to audit. You can select all accounts, including existing accounts and accounts created in the future, or specify accounts. All accounts are selected by default. When you switch to specified accounts, an account selection field appears. You can select multiple accounts or search for accounts.
     SQL Type	Select the SQL types to record. Versions 4.2.5 to 4.4.1: Connection: Login/Logout/Connect/Disconnect Table access: Query/DML (SELECT/INSERT/UPDATE/DELETE) General event: DDL/Privilege change/System administration

9. You can click the icon in the Actions column of a tenant to modify the audit rules or disable SQL audit.

Modify the storage duration

1. In the tenant list on the SQL Audit tab, click Modify Storage Duration in the Actions column of the target tenant.

2. Configure the following parameters in the dialog box:

   • Configuration Scope: Displays the current tenant name.
   • Apply to Other Tenants in the Instance: Select this option to synchronize the configuration to other tenants in the instance for which SQL audit is enabled.
   • Total Storage Duration: Set a value from 7 to 720 days. SQL execution records older than the specified duration are deleted.

3. Click OK.

Disable SQL audit

1. In the tenant list on the SQL Audit tab, click Disable SQL Audit in the Actions column of the target tenant.

2. Enter close in the text box of the dialog box, and then click Disable.

View and download SQL audit records

1. On the SQL Audit tab, click Expand.

2. Specify filter conditions. All the following filter items are optional.

   Filter item	Description
   Database	Select one or more databases in the tenant.
   Node	Select one or more nodes.
   Keyword	Enter one or more keywords that may appear in the SQL statements. Use “and” or “or” to define the relationship between keywords.
   Username	Enter one or more tenant names.
   Operation Type	Select one or more operation types from the drop-down list.
   Client IP	Enter a client IP address.
   Scanned Records	Enter a range for the number of scanned records.
   Execution Duration (ms)	Enter an execution duration range for SQL statements.
   Time Range	Select a SQL execution time range. The time range cannot exceed 6 hours.

3. View the following information in the query results: SQL Statement, Database, User, Client IP, Operation Type, Execution Result, Request Time, Execution Duration (ms), Scanned Rows, and Updated Rows.

4. Click the icon in the upper-right corner to download the query result list.

   Note

   You can currently download a maximum of 100 audit records. If the query returns more than 100 records, only the first 100 records are downloaded based on the page sort order.