结果验证

审计模块功能的结果验证主要是审计日志的查询。

如传统审计的查询：

gaussdb=# SELECT * FROM pg_query_audit('2024-03-23 15:50:00','2024-03-23 16:30:00') WHERE username='audit_t1' and type='ddl_table';
          time          |   type    | result | userid | username | database |  client_conninfo  | object_name |                 detail_info             
    | node_name |            thread_id            | local_port | remote_port 
------------------------+-----------+--------+--------+----------+----------+-------------------+-------------+-----------------------------------------
----+-----------+---------------------------------+------------+-------------
 2024-03-23 15:51:15+08 | ddl_table | ok     | 20839  | audit_t1 | gaussdb | gsql@192.168.0.99 | t1          | create table t1(id int);                
    | dn_6001   | 281431669195952@764495475555777 | 8000       | 36548
 2024-03-23 16:02:48+08 | ddl_table | ok     | 20839  | audit_t1 | gaussdb | gsql@192.168.0.99 | t1          | alter table t1 add column name varchar(2
0); | dn_6001   | 281430353822896@764496168035630 | 8000       | 36628
 2024-03-23 16:03:23+08 | ddl_table | ok     | 20839  | audit_t1 | gaussdb | gsql@192.168.0.99 | t1          | drop table t1;                          
    | dn_6001   | 281430353822896@764496203155439 | 8000       | 36636
(3 rows)

统一审计的查询：

Oct  9 15:38:11 localhost PGAUDIT: AUDIT EVENT: user name: [user001], app_name: [gsql], client_ip: [local], access type: [INSERT], policy id: [16423], table: [public.table_security_auditing], result: [OK]
Oct  9 15:38:11 localhost PGAUDIT: AUDIT EVENT: user name: [user001], app_name: [gsql], client_ip: [local], access type: [UPDATE], policy id: [16423], table: [public.table_security_auditing], result: [OK]
Oct  9 15:38:11 localhost PGAUDIT: AUDIT EVENT: user name: [user001], app_name: [gsql], client_ip: [local], access type: [DELETE], policy id: [16423], table: [public.table_security_auditing], result: [OK]

审计管理员登录数据库，使用系统函数gs_query_unified_audit查询统一审计策略

1

gaussdb=# SELECT * FROM gs_query_unified_audit(sysdate-1,sysdate+1) WHERE type='audit_policy';

查询结果如下：

          time          |     type     | result | userid | username | database | client_conninfo |               object_name          
     |                         detail_info                          | node_name |            thread_id            | local_port | remot
e_port | policy_id | unified_audit_type |                         unified_audit_policy                         
------------------------+--------------+--------+--------+----------+----------+-----------------+------------------------------------
-----+--------------------------------------------------------------+-----------+---------------------------------+------------+------
-------+-----------+--------------------+----------------------------------------------------------------------
 2025-04-26 14:49:54+08 | audit_policy | ok     | 16761  | user001  | postgres | gsql@[local]    | table: [public.table_security_audit
ing] | insert into table_security_auditing values(1,'22');          | datanode  | 139686500628224@798965394386913 | 17778      | 46946 
       | 16785     | access             | INSERT
 2025-04-26 14:49:54+08 | audit_policy | ok     | 16761  | user001  | postgres | gsql@[local]    | table: [public.table_security_audit
ing] | update table_security_auditing set name=234123 where id=1;   | datanode  | 139686500628224@798965394390539 | 17778      | 46946 
       | 16785     | access             | UPDATE