AUDIT_LOG_ENCRYPTION_PASSWORD_GET

Purpose

This function returns the encryption password corresponding to the pwd_id (encryption key identifier) in the archived audit log file name, for offline decryption, forensics, or integration with external tools in a controlled environment.

Syntax

AUDIT_LOG_ENCRYPTION_PASSWORD_GET(pwd_id);

Privilege requirements

You must have the SUPER privilege to use this function.

Considerations

Parameters

• pwd_id: The identifier of the key corresponding to the fields after the .enc. segment in the name of the encrypted archived file. It is of the INT type.

Limitations

Same as other audit functions (expressions): it must be directly and uniquely specified as an output column of a SELECT statement and cannot appear in a subquery. For more information, see the "Limitations and considerations" section in Overview of audit functions.

Return value

The output of the expression is a string.

• If the query is successful, the password corresponding to the pwd_id is returned.
• If the query fails, the SELECT statement may still execute successfully, and the output of the expression is an error message.

Examples

Assume that the name of an archived file is audit.log.20231031080646317.enc.1001. You can pass 1001 as the pwd_id (replace it with the identifier parsed from the actual file name).

SELECT AUDIT_LOG_ENCRYPTION_PASSWORD_GET(1001);

The return result is as follows (the actual key content is omitted):

+-------------------------------------------+
| AUDIT_LOG_ENCRYPTION_PASSWORD_GET(1001)   |
+-------------------------------------------+
| <Password>                                |
+-------------------------------------------+
1 row in set

References

• AUDIT_LOG_ENCRYPTION_PASSWORD_SET
• Set up audit rules