AUDIT_LOG_ENCRYPTION_PASSWORD_GET

Purpose

This function returns the encryption password for the corresponding archived file based on the pwd_id (encryption key identifier) in the archived audit log file name. This password is used for offline decryption, forensics, or integration with external tools in a controlled environment.

Syntax

AUDIT_LOG_ENCRYPTION_PASSWORD_GET(pwd_id);

Privilege requirements

You must have the SUPER privilege to use this function.

Description

Parameters

• pwd_id: The key identifier after the .enc. segment in the encrypted archive file name, such as 1001. This parameter is of the INT type.

Limitations

Like other audit functions (expressions), they must be used directly and exclusively as output columns in a SELECT statement, and cannot be used in subqueries. For details, see the "Limitations and considerations" section in Overview of audit functions.

Return value

The expression is output as a string.

• When the query is successful, returns the password corresponding to pwd_id.
• When a query fails, the SELECT statement may still execute successfully, with the expression outputting an error message.

Examples

Assuming the archive file name is audit.log.20231031080646317.enc.1001, you can pass 1001 as pwd_id (please replace with the identifier parsed from your actual file name).

SELECT AUDIT_LOG_ENCRYPTION_PASSWORD_GET(1001);

The return result is as follows (the actual key content is omitted):

+-------------------------------------------+
| AUDIT_LOG_ENCRYPTION_PASSWORD_GET(1001)   |
+-------------------------------------------+
| <password>                                |
+-------------------------------------------+
1 row in set

References

• AUDIT_LOG_ENCRYPTION_PASSWORD_SET
• Set up audit rules