Help Center> Database Security Service> User Guide> Enabling and Using Database Audit (by Installing Agents)> Process Overview
View PDF

Process Overview

This section describes how to quickly enable database audit.

Background

Database audit supports auditing user-installed databases on ECS/BMS as well as RDS databases on Huawei Cloud.

Create a database audit instance, connect the instance with the target database, and enable database audit.

Auditing Databases Without Agents

Databases of some types and versions can be audited without using agents, as shown in Table 1.

Table 1 Agent-free relational databases

Database Type

Supported Edition

GaussDB(for MySQL)

All editions are supported by default.

RDS for SQLServer

(Supported by CTS 23.02.27.182148 and later versions)

All editions are supported by default.

RDS for MySQL
  • 5.6 (5.6.51.1 or later)
  • 5.7 (5.7.29.2 or later)
  • 8.0 (8.0.20.3 or later)

GaussDB(DWS)
  • 8.2.0.100 or later

PostGresql

(Supported by CTS 23.04.17.123301 and later versions)
  • 14 (14.4 or later)
  • 13 (13.6 or later)
  • 12 (12.10 or later)
  • 11 (11.15 or later)
  • 9.6 (9.6.24 or later)
  • 9.5 (9.5.25 or later)
Figure 1 Agent-free auditing process
Table 2 Procedure for quickly configuring database audit

Step

Configuration

Description

1

Adding a Database

Purchase database audit. Add a database to the database audit instance and enable audit for the database.

Apply for database audit. Add a database to the database audit instance and enable audit for the database.

2

Enabling Database Audit

Enable database audit and connect the added database to the database audit instance.

3

Viewing the Audit Results

By default, database audit complies with a full audit rule, which is used to audit all databases that are connected to the database audit instance. You can view the audit result on the database audit page.

NOTICE:

You can set database audit rules as required. For details, see Adding Audit Scope.

Auditing Databases Using Agents

For a database whose type and version are not listed in Table 1, you need to install an agent to enable the database audit.

Figure 2 Procedure for quickly configuring database audit
Table 3 Procedure for quickly configuring database audit

Step

Configuration

Description

1

Adding a Database

Purchase database audit. Add a database to the database audit instance and enable audit for the database.

2

Adding an Agent

Select an agent add mode.

Database audit supports auditing databases built on ECS, BMS, and RDS on Huawei Cloud. Select an agent add mode based on your database deployed on Huawei Cloud.

3

Adding Security Group Rules

Configure TCP (port 8000) and UDP (ports 7000 to 7100) in the security group inbound rule of the database audit instance to allow the agent to communicate with the audit instance.

4

Installing an Agent (Linux OS)

Download and then install the agent on the database or application based on the add mode you chose.

5

Enabling Database Audit

Enable database audit and connect the added database to the database audit instance.

6

Viewing the Audit Results

By default, database audit complies with a full audit rule, which is used to audit all databases that are connected to the database audit instance. You can view the audit result on the database audit page.

NOTICE:

You can set database audit rules as required. For details, see Adding Audit Scope.

Deploying the Database Audit Agent in a Container

For a database of any types and versions, you can deploy the agent using a container to enable database audit.

For details, see Deploying the Database Audit Agent in a Container.

Helpful Links

Verifying the Result

When you connect the added database to the database audit instance, database audit records all operations performed on the database. You can view the audit result on the database audit page.