Enabling SQL Audit

Figure 1 Setting SQL audit

The Operations option is available only in the CN North-Beijing4, CN South-Guangzhou, and CN-Hong Kong regions. To use this option in other regions, submit a service ticket.

The SQL statements executed by PreparedStatement and scheduled tasks through a MySQL client will be treated as PREPARED_STATEMENT and CREATE, respectively. However, the SQL statements executed by PreparedStatement through JDBC will not be recorded.

After SQL audit is enabled, Data Definition Language (DDL), Data Manipulation Language (DML), Data Control Language (DCL), and other operation types are supported. The details are as follows:

Disabling SQL audit

To disable SQL audit, toggle (enabled) to (disabled).

If you select the check box "I acknowledge that after audit log is disabled, all audit logs are deleted." and click OK, all audit logs will be deleted.

Deleted audit logs cannot be recovered. Exercise caution when performing this operation.

Figure 2 Enabling audit log ingestion to LTS

• After this function is enabled, audit logs record all requests sent to your DB instance and are stored in LTS.
• Check whether Continue to Collect Logs When the Free Quota Is Exceeded is enabled. If it is not enabled, log uploads will fail once 500 MB of logs have been sent to LTS. For more information, see Setting LTS Log Collection Quota and Usage Alarms.
• Once configured, there is a delay of approximately 10 minutes before the changes are applied.
• You will be billed for enabling this function. For details, see LTS pricing details.
• After this function is enabled, all audit policies are reported by default.

• Before enabling both SQL audit logging or audit log ingestion to LTS, keep the following points in mind:
  • Enabling either SQL audit logging or audit log ingestion to LTS will generate audit logs. Sensitive information contained in these audit logs is not anonymized.
  • If SQL audit logging is already enabled and you then enable audit log ingestion to LTS, LTS will continue to reuse the existing audit policy configured for your instance. In addition to the original audit log billing, you will be billed for ingesting audit logs to LTS. The original audit log billing will stop only after you disable the original audit policy.
  • If SQL audit logging is already enabled and you then enable audit log ingestion to LTS, for the sake of instance stability, you are advised to keep the original audit policy enabled for a period of time. After confirming that audit log ingestion to LTS is functioning properly, you may then disable the original audit policy.
• Audit logs may be lost while being uploaded to LTS in certain situations. If audit logging is enabled, you can download all audit logs from OBS.
  • There is a low probability that some logs are lost when the service traffic is heavy, audit logs are generated too fast, or the LTS service fails.
  • Each audit log record uploaded to LTS cannot exceed 512 KB. Larger records will be truncated.

Figure 3 List view

Figure 4 Analysis view

• The analysis view displays log details directly, whereas the list view requires you to download the logs to view them. The log content in both views is the same. For explanations of the fields in the analysis view, see Table 1.
• For details about each module in the analysis view, see Viewing Log Management.