このページは、お客様の言語ではご利用いただけません。Huawei Cloudは、より多くの言語バージョンを追加するために懸命に取り組んでいます。ご協力ありがとうございました。
- What's New
- Function Overview
- Service Overview
- Billing
- Getting Started
-
User Guide
- Overview
- Enabling and Using Database Audit (by Installing Agents)
- Enabling and Using Database Audit (Without Installing Agents)
- Upgrading the Database Audit Instance Version
- Configuring Audit Rules
- Viewing Audit Results
- Notification Settings Management
- Viewing Monitoring Information
- Backing Up and Restoring Database Audit Logs
-
Other Operations
- Managing Database Audit Instances
- Viewing the Instance Overview
- Managing Databases and Agents
- Uninstalling an Agent
- Management an Audit Scope
- Viewing Information About SQL Injection Detection
- Managing Risky Operations
- Managing Privacy Data Protection Rules
- Managing Audit Reports
- Managing Backup Audit Logs
- Viewing Operation Logs
- Key Operations Recorded by CTS
- Monitoring
- Shared VPC
- Permission Control
-
Best Practices
- Auditing a User-built Database on ECS
- Auditing an RDS DB instance (with Agents)
- Auditing an RDS DB Instance (Without Agents)
- Deploying the Database Audit Agent in a Container
- Checking for Slow SQL Statements
- Checking for Data Reduction
- Checking for Dirty Tables
- Configuring Oracle RAC Cluster Audit
- Meeting Database Audit Compliance Requirements
- Configuring Database Audit Instance Rules
- Change History
-
API Reference
- Before You Start
- Calling APIs
-
API
- Querying on the Management Side
-
Audit Instance
- Deleting an Audit Instance
- Creating an Audit Instance in Yearly/Monthly Billing Mode
- Querying Information About an Instance Creation Task
- Querying the Audit Instance List
- Changing a Security Group
- Starting an Audit Instance
- Stopping an Audit Instance
- Restarting an Audit Instance
- Updating Audit Instance Information
- Auditing a Database
- Auditing Agent
- Data Analytics
- Audit Rules
- TMS Tags
- Adding an RDS Database (Deprecated)
- Appendix
-
FAQs
-
Product Consulting
- What Is Database Audit?
- What Are the Differences Between DBSS Database Audit and RDS SQL Audit?
- What Editions Does DBSS Provide?
- What Databases on Huawei Cloud Does DBSS Protect?
- What Databases Does DBSS Support?
- Why Can't I See the Instance that Is Being Created After I Purchased It?
- Will My Services Be Affected If I Do Not Renew DBSS After It Expires?
- Does Database Audit Support On-premises or Non-Huawei Cloud Databases?
- What Are Regions and AZs?
- Does DBSS Support Real-Time Data Masking?
- Can DBSS Audit Databases Across Subnets?
- Is There Any Restriction on the Gateway IP Address of DBSS Audit Instances?
-
Purchase
- Which Subnet Should I Choose When Purchasing an Instance?
- Why Do I Need to Select a VPC When Buying an Instance?
- How Many Database Audit Instances Can I Purchase in the Same Region?
- What Do I Do If a Message Indicating Insufficient Quota Is Displayed During Instance Purchase?
- How Do I Renew Database Audit?
- How Do I Unsubscribe from DBSS?
-
Functions
- Can Database Audit Be Used Across AZs?
- Does Database Audit (in Bypass Mode) Affect My Services?
- Is the Database Audit Function Available to Users Other Than the Buyer?
- What Are the Functions of Database Audit?
- Supported Database Types
- What OSs Can I Install the Database Audit Agent On?
- Does Database Audit Support Bidirectional Audit?
- Can I Audit Databases Across Different VPCs?
- Can Applications Using TLS Connections Be Audited?
- How Long Is the Database Audit Data Stored by Default?
- How Soon Can I Receive an Alarm Notification If an Exception Occurs in Database Audit?
- Is the Total Number Of Alarms Every Day the Same as that of Emails?
- Why I Cannot Preview the Database Security Audit Report Online?
- If I Use Middleware at the Service Side, Will It Affect Database Audit?
- Can DBSS Capture SQL Statements Executed by Third-Party Tools?
- Can DBSS Be Deployed Off the Cloud?
- Can I Change the VPC of a DBSS Instance?
- How Do I Interconnect with DBSS Audit Data Storage?
- What Should I Do If an Alarm of Insufficient DBSS Capacity Is Displayed?
-
Agent
- Which Functions Do the Database Audit Agent Provide?
- On What Windows Versions Can I Install the Agent?
- On What Linux OSs Can I Install the Agent?
- What Is the Process Name of the Database Audit Agent?
- (Linux OS) What Should I Do If I Lack the Permission to Run the Agent Installation Script?
- (Linux OS) Where Are the Logs of the Database Audit Agent Saved?
- When Should I Select an Existing Agent?
- What Do I Do If the Database Audit Agent Is Hibernating?
- How Do I Deploy the Agent If I Have an RDS Database That Connects to Multiple ECSs?
- How Do I Determine Where to Install an Agent?
- How Do I Run a Database Audit Agent?
- How Do I Check the Status of the Database Audit Agent?
- How Do I Download a Database Audit Agent?
- How Do I Uninstall a Database Audit Agent?
- Can I Modify the CPU and Memory Thresholds of the Agent?
- How Do I Install the Agent (in Linux OS)?
- How Do I Install the Agent (in Windows OS)?
- What Do I Do If the Communication Between the Agent and Database Audit Instance Is Abnormal?
- How Many Resources Are Consumed by an Agent When It Runs on a Node?
- What Do I Do If Agent Installation Fails?
- What Do I Do If the Error Message "unsupport this Linux version, please check your Linux version with install document!" Is Displayed During Agent Installation?
-
Operations
- How Do I Configure Database Audit?
- How Do I Disable SSL for a Database?
- How Do I Set the INSERT Audit Policy for Database Audit?
- How Do I Verify My Database Audit Configuration?
- How Do I Set Database Audit Rules for All Databases?
- How Do I Check the Version of Database Audit?
- How Do I View All Alarms in Database Audit?
- How Do I Audit an RDS Database Accessed through Intranet (by Applications Off the Cloud)?
- How Do I Add an HBase Database and Perform Audit?
-
Troubleshooting
- Database Audit Is Running Properly But Generates No Audit Records
- Database Audit Is Unavailable
- Alarm Notifications Are Abnormal
- Why I Failed to Access the DBSS Purchase Page?
- What Do I Do If I Audit RDS Psostgres Database but No Audit Result Is Displayed?
- DBSS Automatic Backup Failed and The Failure Code is "Export backup file failed"
-
Logs
- Can the Operation Logs of Database Audit Be Migrated?
- How Long Are the Operation Logs of Database Audit Saved by Default?
- How Do I Check the Operation Logs of Database Audit?
- How Does Database Audit Process Logs?
- How Do I Back Up the Database Audit Logs?
- Can Database Audit Logs Be Directly Saved to OBS?
- Backup Gets Stuck at the Backup File Uploading Phase
- Change History
-
Product Consulting
- Videos
-
More Documents
-
User Guide (ME-Abu Dhabi Region)
- Overview
- Process Overview
- Applying for a Database Audit Instance
- Step 1: Add a Database
- Step 2: Add an Agent
- Step 3: Download and Install the Agent
- Step 4: Add a Security Group Rule
- Step 5: Enable Database Audit
- Adding Audit Scope
- Enabling or Disabling SQL Injection Detection
- Adding Risky Operations
- Configuring Privacy Data Protection Rules
- Viewing SQL Statement Details
- Viewing Session Distribution
- Viewing the Audit Dashboard
- Viewing Audit Reports
- Configuring Alarm Notifications
- Viewing the System Monitoring
- Viewing the Alarms
- Managing Database Audit Instances
- Viewing the Instance Overview
- Managing Databases and Agents
- Uninstalling an Agent
- Management an Audit Scope
- Viewing Information About SQL Injection Detection
- Managing Risky Operations
- Managing Privacy Data Protection Rules
- Managing Audit Reports
- Managing Backup Audit Logs
- Viewing Operation Logs
- Viewing Tracing Logs
- Auditable Operations
-
FAQs
- Product Consulting
-
Functions
- Does Database Audit (in Bypass Mode) Affect My Services?
- What Are the Functions of Database Audit?
- Supported Database Types
- What OSs Can I Install the Database Audit Agent On?
- Does Database Audit Support Bidirectional Audit?
- Can I Audit Databases Across Different VPCs?
- Can Applications Using TLS Connections Be Audited?
- How Long Is the Database Audit Data Stored by Default?
- How Soon Can I Receive an Alarm Notification If an Exception Occurs in Database Audit?
- Is the Total Number Of Alarms Every Day the Same as that of Emails?
- Why I Cannot Preview the Database Security Audit Report Online?
- If I Use Middleware at the Service Side, Will It Affect Database Audit?
- What Should I Do If an Alarm of Insufficient DBSS Capacity Is Displayed?
-
Agent
- Which Functions Do the Database Audit Agent Provide?
- On What Windows Versions Can I Install the Agent?
- On What Linux OSs Can I Install the Agent?
- What Is the Process Name of the Database Audit Agent?
- (Linux OS) What Should I Do If I Lack the Permission to Run the Agent Installation Script?
- (Linux OS) Where Are the Logs of the Database Audit Agent Saved?
- When Should I Select an Existing Agent?
- What Do I Do If the Database Audit Agent Is Hibernating?
- How Do I Determine Where to Install an Agent?
- How Do I Download a Database Audit Agent?
- How Do I Uninstall a Database Audit Agent?
- How Do I Install the Agent (in Windows OS)?
- What Do I Do If the Communication Between the Agent and Database Audit Instance Is Abnormal?
- How Many Resources Are Consumed by an Agent When It Runs on a Node?
- Operations
- Troubleshooting
-
Logs
- Can the Operation Logs of Database Audit Be Migrated?
- How Long Are the Operation Logs of Database Audit Saved by Default?
- How Do I Check the Operation Logs of Database Audit?
- How Does Database Audit Process Logs?
- How Do I Back Up the Database Audit Logs?
- Can Database Audit Logs Be Directly Saved to OBS?
- Change History
-
User Guide (Kuala Lumpur Region)
- Overview
- Applying for a Database Audit Instance
- Quick Start
- Step 1: Add a Database
- Step 2: Add an Agent
- Step 3: Add a Security Group Rule
- Step 4: Download and Install the Agent
- Step 5: Enable Database Audit
- Step 6: View Audit Results
- Configuring Audit Rules
- Viewing Monitoring Information
- Backing Up and Restoring Database Audit Logs
-
Other Operations
- Managing Database Audit Instances
- Viewing the Instance Overview
- Managing Databases and Agents
- Uninstalling an Agent
- Management an Audit Scope
- Viewing Information About SQL Injection Detection
- Managing Risky Operations
- Managing Privacy Data Protection Rules
- Managing Audit Reports
- Managing Backup Audit Logs
- Viewing Operation Logs
-
FAQs
- Product Consulting
-
Functions
- Does Database Audit (in Bypass Mode) Affect My Services?
- What Are the Functions of Database Audit?
- Supported Database Types
- What OSs Can I Install the Database Audit Agent On?
- Does Database Audit Support Bidirectional Audit?
- Can I Audit Databases Across Different VPCs?
- Can Applications Using TLS Connections Be Audited?
- How Long Is the Database Audit Data Stored by Default?
- How Soon Can I Receive an Alarm Notification If an Exception Occurs in Database Audit?
- Is the Total Number Of Alarms Every Day the Same as that of Emails?
- Why I Cannot Preview the Database Security Audit Report Online?
- If I Use Middleware at the Service Side, Will It Affect Database Audit?
- What Should I Do If an Alarm of Insufficient DBSS Capacity Is Displayed?
-
Agent
- Which Functions Do the Database Audit Agent Provide?
- On What Linux OSs Can I Install the Agent?
- What Is the Process Name of the Database Audit Agent?
- (Linux OS) What Should I Do If I Lack the Permission to Run the Agent Installation Script?
- (Linux OS) Where Are the Logs of the Database Audit Agent Saved?
- When Should I Select an Existing Agent?
- What Do I Do If the Database Audit Agent Is Hibernating?
- How Do I Determine Where to Install an Agent?
- How Do I Download a Database Audit Agent?
- How Do I Uninstall a Database Audit Agent?
- What Do I Do If the Communication Between the Agent and Database Audit Instance Is Abnormal?
- How Many Resources Are Consumed by an Agent When It Runs on a Node?
- What Do I Do If Agent Installation Fails?
- Operations
- Troubleshooting
-
Logs
- Can the Operation Logs of Database Audit Be Migrated?
- How Long Are the Operation Logs of Database Audit Saved by Default?
- How Do I Check the Operation Logs of Database Audit?
- How Does Database Audit Process Logs?
- How Do I Back Up the Database Audit Logs?
- Can Database Audit Logs Be Directly Saved to OBS?
- Backup Gets Stuck at the Backup File Uploading Phase
- Change History
-
User Guide (Paris and Amsterdam Regions)
- Overview
- Enabling and Using Database Audit (by Installing Agents)
- Enabling and Using Database Audit (Without Installing Agents)
- Adding Audit Scope
- Enabling or Disabling SQL Injection Detection
- Adding Risky Operations
- Configuring Privacy Data Protection Rules
- Viewing SQL Statement Details
- Viewing Session Distribution
- Viewing the Audit Dashboard
- Viewing Audit Reports
- Configuring Alarm Notifications
- Viewing the System Monitoring
- Viewing the Alarms
- Managing Database Audit Instances
- Viewing the Instance Overview
- Managing Databases and Agents
- Uninstalling an Agent
- Management an Audit Scope
- Viewing Information About SQL Injection Detection
- Managing Risky Operations
- Managing Privacy Data Protection Rules
- Managing Audit Reports
- Managing Backup Audit Logs
- Viewing Operation Logs
- Viewing Tracing Logs
- Auditable Operations
-
FAQs
-
Functions
- Does Database Audit (in Bypass Mode) Affect My Services?
- What Are the Functions of Database Audit?
- Supported Database Types
- What OSs Can I Install the Database Audit Agent On?
- Does Database Audit Support Bidirectional Audit?
- Can Applications Using TLS Connections Be Audited?
- How Long Is the Database Audit Data Stored by Default?
- How Soon Can I Receive an Alarm Notification If an Exception Occurs in Database Audit?
- Is the Total Number Of Alarms Every Day the Same as that of Emails?
- Why I Cannot Preview the Database Security Audit Report Online?
- If I Use Middleware at the Service Side, Will It Affect Database Audit?
-
Agent
- Which Functions Do the Database Audit Agent Provide?
- On What Linux OSs Can I Install the Agent?
- What Is the Process Name of the Database Audit Agent?
- (Linux OS) What Should I Do If I Lack the Permission to Run the Agent Installation Script?
- (Linux OS) Where Are the Logs of the Database Audit Agent Saved?
- When Should I Select an Existing Agent?
- What Do I Do If the Database Audit Agent Is Hibernating?
- How Do I Determine Where to Install an Agent?
- How Do I Download a Database Audit Agent?
- How Do I Uninstall a Database Audit Agent?
- What Do I Do If the Communication Between the Agent and Database Audit Instance Is Abnormal?
- Operations
- Troubleshooting
- Logs
-
Functions
- Change History
- API Reference (Paris and Amsterdam Regions)
-
User Guide (ME-Abu Dhabi Region)
- General Reference
Copied.
Auditing an RDS DB Instance (Without Agents)
Overview
This section describes how to audit the security of a relational database instance. (Applications connected to this DB instance are deployed on ECS.) DBSS can audit certain types of relational databases without installing agents.
- If the database you want to audit is included in Table 1, use DBSS to audit your database without installing agents by referring to this section.
Table 1 Agent-free relational databases Database Type
Supported Edition
GaussDB(for MySQL)
All editions are supported by default.
RDS for SQLServer
All editions are supported by default.
RDS for MySQL
- 5.6 (5.6.51.1 or later)
- 5.7 (5.7.29.2 or later)
- 8.0 (8.0.20.3 or later)
GaussDB(DWS)
- 8.2.0.100 or later
PostGresql
- 14 (14.4 or later)
- 13 (13.6 or later)
- 12 (12.10 or later)
- 11 (11.15 or later)
- 9.6 (9.6.24 or later)
- 9.5 (9.5.25 or later)
- If the database you want to audit is not included in Table 1, see Auditing an RDS DB instance (with Agents).
DBSS without agents is easy to configure and use, but the following functions are not supported:
- Successful and failed login sessions cannot be counted.
- The port number of the client for accessing the database cannot be obtained.
GaussDB(DWS) has the permission control policy for the log audit function. Only Huawei Cloud accounts and users with the Security Administrator permission can enable or disable the DWS database audit function.
Solution Architecture
The DBSS instance receives the logs sent from databases, such as certain GaussDB(for MySQL) or RDS for MySQL versions, and saves the logs to its log library for security analysis, aggregation statistics, and compliance analysis.

Take the GaussDB(for MySQL) database as an example. Assume you need to locate and track internal violations and improper operations in the database to meet compliance requirements. This section describes how to enable the database audit function and check audit results.
Limitations and Constraints
The database audit instance and the database to be audited must be in the same region.
Step 1: Purchase Database Audit
Configure and purchase the database audit service. For details, see Purchasing Database Audit.
Step 2: Add a Database and Enable Audit
After purchasing database audit, add a database to the database audit instance and enable audit for the database.
- Log in to the management console.
- Select a region and click
. Choose Security & Compliance > Database Security Service. The Dashboard page is displayed.
- In the navigation pane, choose Databases.
- Select an instance from the Instance drop-down list. Click Add Database.
- In the displayed dialog box, set database parameters described in Table 2.
Figure 2 Adding a database
- Click OK. The database will be displayed in the database list and its Audit Status will be Disabled.
Figure 3 Database list
- In the database list, view the information in the Agent column.
- If the message No agent needs to be added is displayed, the database can be audited without installing agents. In this case, go to step 8.
Figure 4 No agent needs to be added
- If Add is displayed, the database can be audited only after an agent is added. In this case, click Add in the Agent column. For details, see Auditing an RDS DB instance (with Agents).
Figure 5 Adding an agent
- If the message No agent needs to be added is displayed, the database can be audited without installing agents. In this case, go to step 8.
- In the Operation column of the database, click Enable.
Figure 6 Enabling database audit
Step 3: Viewing the Audit Result
You can check audit results on the dashboard page, or generate, preview, or download reports.
- Check overview information.
In the navigation pane, choose Dashboard.
The Dashboard page displays the audit duration, total number of SQL statements and risks, statements and risks today, and today's sessions of an instance.
You can click the Statements or Sessions tab to view session distribution.
- Generate, download, or preview reports.
- In the navigation pane, choose Reports.
- Select an instance from the Instance drop-down list. Click the Report Management tab.
- In the Operation column of a report template, click Generate Report.
- In the displayed dialog box, click
to set the start time and end time of the report, and select the database for which you want to generate a report.
- Click OK.
See Figure 7.
NOTICE:
To preview a report online, use Google Chrome or Mozilla FireFox.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot