OceanBase Database uses a series of filters to audit specific events. The filters can filter by dimensions such as account and event type. Each filter can choose whether to audit the filtered events.
Applicability
This topic applies only to OceanBase Database Enterprise Edition. OceanBase Database Community Edition does not support the audit feature.
Audit functions
Note
You can set a default filter that applies to all users who have not explicitly set a filter.
The following table lists the audit functions (expressions) supported by OceanBase Database in MySQL mode.
| Function | Description |
|---|---|
| AUDIT_LOG_FILTER_SET_FILTER | Creates a filter. |
| AUDIT_LOG_FILTER_SET_USER | Sets the filter to a user. |
| AUDIT_LOG_FILTER_REMOVE_USER | Removes the filter from a user. |
| AUDIT_LOG_FILTER_REMOVE_FILTER | Removes a filter. |
Limitations and considerations
An expression must be directly and uniquely placed in a
SELECTstatement's output column (select item) without any parent expressions.Expressions cannot be written in subqueries.
After a filter is defined, it must be set to a user for it to take effect.
A filter can be set to multiple users, and a user can have only one filter.
When a connection is established, the audit filter (Audit Filter) used by the current session is determined and remains unchanged throughout the session.
- Calling
AUDIT_LOG_FILTER_SET_USERandAUDIT_LOG_FILTER_REMOVE_USERto modify the binding between a filter and a user does not affect the current connected session. - Modifying the definition of a filter or deleting a filter affects the connected sessions.
- Calling
AUDIT_LOG_FILTER_REMOVE_FILTERwill cascade delete the binding between the filter and all audit users. Operations under these users will no longer be audited.