OceanBase Database uses a series of filters to audit specific events. Filters can filter dimensions such as account, event type, and event attributes. Each filter can choose whether to audit the filtered events.
Applicability
This topic applies only to OceanBase Database Enterprise Edition. OceanBase Database Community Edition does not support the audit feature.
Audit functions
Note
You can set a default filter to apply to all users who have not explicitly set a filter.
The following table lists the audit functions (expressions) supported in OceanBase Database MySQL-compatible mode.
| Function | Description |
|---|---|
| AUDIT_LOG_FILTER_SET_FILTER | Creates a filter. |
| AUDIT_LOG_FILTER_SET_USER | Sets a filter for a user. |
| AUDIT_LOG_FILTER_REMOVE_USER | Removes a filter from a user. |
| AUDIT_LOG_FILTER_REMOVE_FILTER | Removes a filter. |
Limitations and considerations
An expression must be directly and uniquely placed in an output column of a
SELECTstatement (i.e., a select item) and cannot have parent expressions.An expression cannot be written in a subquery.
After a filter is defined, it must be set for a user to take effect.
A filter can be set for multiple users, and a user can have only one filter.
When a connection is established, the audit filter (Audit Filter) used by the current session is determined and remains unchanged throughout the session.
- Calling
AUDIT_LOG_FILTER_SET_USERandAUDIT_LOG_FILTER_REMOVE_USERto modify the binding between a filter (Filter) and a user (User) does not affect the current connected session. - Modifying the definition of a filter (Filter) or deleting a filter (Filter) affects the connected session.
- Calling
AUDIT_LOG_FILTER_REMOVE_FILTERwill cascade delete the binding between the filter (Filter) and all audit users (Audit User). Operations under the corresponding users will no longer be audited.