Updated on 2023-12-28 GMT+08:00

Downloading SQL Audit Logs

If you enable SQL audit, the system records all SQL operations and uploads logs every half an hour or when the size is accumulated to 100 MB. You can download audit logs to view details. The minimum time unit of audit logs is second. By default, SQL audit is disabled. Enabling this function may affect database performance.


  1. Log in to the management console.
  2. Click in the upper left corner of the page and choose Databases > Relational Database Service.
  3. On the Instances page, click the target DB instance.
  4. In the navigation pane on the left, choose SQL Audits.
  5. On the displayed page, select a time range in the upper right corner, select SQL audit logs to be downloaded in the list, and click Download above the list to download SQL audit logs in batches.

    Alternatively, select an audit log and click Download in the Operation column to download an individual SQL audit log.

  6. The following figure shows the SQL audit log content. For field descriptions, see Table 1.

    Figure 1 RDS for MySQL audit logs
    Table 1 Audit log field description




    ID of a single record, which is the unique global ID of each SQL statement recorded in the audit log.


    ID of the session executed for the record, which is the same as the ID in the show processlist command output.


    Session status, which is usually the returned error code of a statement. If a statement is successfully executed, the value 0 is returned.


    Recorded type name. Generally, DML and DDL operations are QUERY, connection and disconnection operations are CONNECT and QUIT, respectively.


    UTC time for the record.


    SQL command type. The value is the parsed SQL type, for example, select or update. (This field does not exist if the connection is disconnected.)


    Executed SQL statement content. (This field does not exist if the connection is disconnected.)


    Login account.


    Login host. The value is localhost for local login and is empty for remote login.


    External username.


    IP address of the remotely-connected client. For local connection, the field is empty.


    Default database on which SQL statements are executed.