Database Audit

Context

Database audit is critical to the security of the database system. Database audit administrators can use the audit logs to reproduce a series of events that cause faults in the database and identify unauthorized users, unauthorized operations, and the time when these operations are performed.

You need to understand the following information about the audit function:

The GUC parameter audit_enabled is used to enable or disable the audit function. Its value can be dynamically loaded. After you change the switch status when the database is running, the change takes effect immediately and you do not need to restart the database. Its default value is on, indicating that the audit function is enabled.
In addition to the overall audit switch, each audit item has an independent switch. An audit item is available only after its own switch is turned on.
The switch of each audit supports dynamic loading. After changing the audit switch status when the database is running, the modification takes effect immediately without restarting the database.

Table 1 describes the audit items supported by GaussDB. If you need to modify a specific audit configuration item, contact the administrator.

**Table 1** Audit items
Configuration Item	Description
User login and logout audit	Parameter: audit_login_logout Its default value is 7, which indicates that the function of user login and logout audit is enabled. 0 indicates that the function of user login and logout audit is disabled. Other values are not recommended.
Database startup, stop, recovery, and switchover audit	Parameter: audit_database_process Its default value is 1, which indicates that the audit of database startup, stop, recovery, and switchover is enabled.
User locking and unlocking audit	Parameter: audit_user_locked Its default value is 1, which indicates that the audit of user locking and unlocking is enabled.
Unauthorized access audit	Parameter: audit_user_violation Its default value is 0, which indicates that the audit of unauthorized access disabled.
Permission granting and revoking audit	Parameter: audit_grant_revoke Its default value is 1, which indicates that the audit of permission granting and revoking is enabled.
Full audit of user operations	Parameter: full_audit_users Its default value is an empty string, indicating that the default configuration is used and no full audit of user operations is configured.
Names and IP addresses of clients that do not need to be audited	Parameter: no_audit_client Its default value is an empty string, indicating that the default configuration is used and no clients and IP addresses are added to the audit blacklist.
Audit of CREATE, ALTER, and DROP operations on database objects	Parameter: audit_system_object Its default value is 67121159, which indicates that the CREATE, ALTER, and DROP operations only on databases, schemas, users, and node groups are audited.
Audit of INSERT, UPDATE, and DELETE operations on a specific table	Parameter: audit_dml_state Its default value is 0, which indicates that the audit of DML operations (except SELECT) on a specific table is disabled.
SELECT operation audit	Parameter: audit_dml_state_select Its default value is 0, which indicates that the audit of the SELECT operation is disabled.
COPY operation audit	Parameter: audit_copy_exec Its default value is 1, which indicates that the audit of COPY operations is enabled.
Audit of execution of stored procedures and customized functions	Parameter: audit_function_exec Its default value is 0, which indicates that no execution audit logs of stored procedures and customized functions are recorded.
Audit of system functions in the whitelist	Parameter: audit_system_function_exec Its default value is 0, which indicates that audit logs of system function execution are not recorded.
SET operation audit	Parameter: audit_set_parameter Its default value is 0, which indicates that the audit of the SET operation is disabled.
Transaction ID record	Parameter: audit_xid_info Its default value is 0, which indicates that the function of recording transaction IDs in audit logs is disabled.