audit_log_path

Description

audit_log_path specifies the output directory for audit logs.

Privilege requirements

• Query the parameter

  The sys tenant and all user tenants can query this parameter by using the SHOW PARAMETERS statement or the GV$OB_PARAMETERS view.

• Modify the parameter

  The sys tenant and user tenants can use the ALTER SYSTEM SET statement to modify this parameter.

Attributes

Considerations

• Local storage

  Audit logs of different OBServer nodes in the same tenant are written to different directories. If you set the output path of different tenants in the same cluster to the same path, the directory structure will contain a tenant_id layer. The directory structure for local output is as follows:

  - ${audit_log_path}
  - tenant_id_1
  - ip1:port1
      - audit.log.20231031080646317[.zst]
      - audit.log.20231031084835263[.zst]
      - audit.log
  - ip2:port2
      - audit.log.20231031072457838[.zst]
      - audit.log.20231031093023607[.zst]
      - audit.log.20231031101213751[.zst]
      - audit.log
  - tenant_id_2
  

• Cloud storage

  OceanBase Database supports multiple OBServer nodes outputting audit logs to the same oss/nfs directory. To ensure the performance of concurrent file appending and the subsequent compression and encryption operations, only archived files are stored in cloud storage. Appended files are stored in the local audit directory. Therefore, some of the latest audit log records may only exist on the local OBServer nodes and are not visible to downstream consumers.

Examples

• Set the output directory for audit logs to file:///logs/audit.

  obclient> ALTER SYSTEM SET audit_log_path='file:///logs/audit';
  

• Set the output directory for audit logs to oss://$OSS_ACCESS_ID:$OSS.......

  obclient> ALTER SYSTEM SET audit_log_path='oss://$OSS_ACCESS_ID:$OSS_ACCESS_KEY@$OSS_HOST/test/audit/';
  

References

• Overview of security audit