Audit Log Upload Policy Description

Scenario

On the RDS console, audit logs are normally uploaded to OBS and a log file is generated every half an hour or for every 100 MB. In this case, however, the audit logs were uploaded twice within two minutes and the size of the audit logs was less than 100 MB.

Possible Causes

Audit log rotation policy: Logs are uploaded to OBS every half an hour or when the accumulated size reaches 100 MB.

1. The rotation interval for audit logs is half an hour. The time under Updated on the console is when the last SQL statement is written to the audit log file. Based on the update time, you can easily analyze downloaded logs.
2. In certain special cases, such as when the standby instance is being rebuilt or a primary/standby switchover is being performed, audit logs are forcibly rotated. As a result, a new audit log file less than 100 MB is generated within half an hour. This scenario is normal.