OceanBase Database uses a series of filters to audit specific events. The filters can filter events based on dimensions such as account and event type. Each filter can choose whether to audit the filtered events.
Applicability
This topic applies only to OceanBase Database Enterprise Edition. OceanBase Database Community Edition does not support audit features.
Audit functions
Note
You can set a default filter to apply to all users that have not explicitly set a filter.
The following table lists the audit functions (expressions) supported in OceanBase Database MySQL mode.
| Function | Description |
|---|---|
| AUDIT_LOG_FILTER_SET_FILTER | Creates a filter. |
| AUDIT_LOG_FILTER_SET_USER | Sets a filter to a user. |
| AUDIT_LOG_FILTER_REMOVE_USER | Removes a filter from a user. |
| AUDIT_LOG_FILTER_REMOVE_FILTER | Removes a filter. |
Limitations and considerations
Expressions must be directly and uniquely placed in a
SELECTstatement's output column (select item) without any parent expressions.Expressions cannot be written in subqueries.
After a filter is defined, it must be set to a user for it to take effect.
The relationship between filters and users is one-to-many. A single filter can be set to multiple users, but a user can only have one filter.
When a connection is established, the audit filter (Audit Filter) used by the current session is determined and remains unchanged throughout the session.
- Calling
AUDIT_LOG_FILTER_SET_USERandAUDIT_LOG_FILTER_REMOVE_USERto modify the binding between a filter and a user does not affect the currently connected session. - Modifying the definition of a filter or deleting a filter affects the currently connected session.
- Calling
AUDIT_LOG_FILTER_REMOVE_FILTERwill cascade delete the binding between the filter and all audit users, and operations under these users will no longer be audited.