Log Types Supported by DWS Clusters

Application Scenarios

• Fault locating: When a cluster is abnormal, logs can be used to quickly locate the root cause.
• Security audit: Logs can be used to trace database operation history to meet compliance requirements.
• Performance analysis: Logs can be used to analyze SQL statement execution and system resource usage.
• Change tracking: Logs record operations on the console and cluster configuration changes.
• Log dump: Logs can be archived to object storage for long-term storage.

Database Audit Logs

If the Security function is enabled, DWS records any DML and DDL operations performed by the database. You can locate and analyze faults based on the database audit logs, and perform behavior analysis and security auditing on historical database operations to improve DWS security. For how to enable and view database audit logs, see Viewing DWS Database Audit Logs.

How logs are generated: Database audit logs are automatically generated by the DWS database kernel when it receives SQL requests. When a user executes a DML statement (such as INSERT, UPDATE, and DELETE) or DDL statement (such as CREATE, ALTER, and DROP), the database kernel writes the operation information (including the operator, execution time, SQL statement, and execution result) into an audit log file. Audit logs are enabled by default. You can configure audit policies on the Security Settings page and select the types of operations to be audited and audit levels.

Management Console Audit Logs

DWS uses Cloud Trace Service (CTS) to record mission-critical operations performed on the DWS console, such as cluster creation, snapshot creation, cluster scale-out, and cluster restart. The logs can be used in purposes such as security analysis, compliance audit, resource tracing, and fault locating. For details about how to enable and view audit logs of management console events, see Viewing DWS Console's Operation Logs.

How logs are generated: Management console audit logs are generated by Cloud Trace Service (CTS). When a user performs an operation (such as creating, scaling in or out, or restarting a cluster) on the DWS management console, CTS captures the operation and records information such as the operator, operation time, operation type, request parameters, and response. Before using CTS, you need to enable it. After CTS is enabled, a tracker will be automatically created. All operations recorded by the system are associated with the tracker.

Other Logs

By interconnecting DWS with the Log Tank Service (LTS), you can enable LTS to collect logs of DWS clusters and can view and dump the collected cluster logs on the LTS console. For how to enable and view other logs, see Viewing Other Logs of the DWS Cluster.

How logs are generated: Log Tank Service (LTS) automatically collects logs from each node in a DWS cluster. A DWS cluster generates various types of run logs, which are periodically collected by LTS through the log collection agent (ICAgent) and centrally stored in LTS. You can query, analyze, and dump logs (to OBS) on the LTS console.

The following table lists the supported log types.

Documentation

• Functions for viewing database audit logs: pg_query_audit() and pgxc_query_audit()
• Guide to connecting DWS to LTS: Ingesting DWS Logs to LTS