Purchasing and Enabling DBSS

Operation Process

Preparation

• Before purchasing DBSS, create a Huawei account and subscribe to Huawei Cloud. For details, see Registering a Huawei ID and Enabling Huawei Cloud Services and Real-Name Authentication.

  If you have enabled Huawei Cloud and completed real-name authentication, skip this step.

• Ensure that your account has sufficient balance.

Step 1: Buy Starter Edition DBSS

1. Log in to the management console.
2. Click and choose Security & Compliance > Database Security Service. The Dashboard page is displayed.
3. In the upper right corner, click Buy Database Audit.
4. On the DBSS purchase page, complete the following configurations.

   Table 1 Database audit instance parameters

   Module	Parameter	Example Value	Description
   Basic settings	Service Type	Database Audit Service	The value is fixed at Database Audit Service.
   	Billing Mode	Yearly/Monthly	Only the yearly/monthly mode is available.
   	Region	CN East-Shanghai1	Select the region where the instance is located. Regions are geographic areas isolated from each other. Resources are region-specific and cannot be used across regions through internal network connections. For low network latency and quick resource access, select the nearest region.
   	AZ Type	General	Only general AZs are supported.
   	AZ	Randomly assign	You can select random allocation or specify an AZ.
   Edition	Edition	Starter - Database Audit Starter Edition	You can select Starter, Basic, Professional, or Advanced Edition. For details about the specifications parameters of each edition, see Purchasing DBSS.
   Network Configuration	VPC	default_vpc	You can select an existing VPC, or click View VPC to create one on the VPC console. NOTE: Select the VPC of the node (application or database side) where you plan to install the agent. For more information, see How Do I Determine Where to Install an Agent? To change the VPC of a DBSS instance, unsubscribe from it and purchase a new one. For more information about VPC, see Virtual Private Cloud User Guide.
   	Subnet	default_subnet	You can select a subnet configured in the VPC or create a subnet on the VPC console.
   	Security Group	default	You can select an existing security group in the region or create a security group on the VPC console. Once a security group is selected for an instance, the instance is protected by the access rules of this security group. For more information about security groups, see Virtual Private Cloud User Guide.
   Advanced Settings	Name	DBSS-test	Instance name
   	Remarks	-	You can add instance remarks.
   	Enterprise Project	default	This parameter is provided for enterprise users. An enterprise project groups cloud resources, so you can manage resources and members by project. The default project is default. Select an enterprise project from the drop-down list. For more information about enterprise project, see Enterprise Management User Guide.
   	Tag	-	(Optional) Identifier of the database audit instance. Adding tags helps you better identify and manage your database instances. A maximum of 50 tags for each instance If you have configured tag policies for DBSS, you need to add tags to your DBSS instances based on the tag policies. If a tag does not comply with the policies, DBSS instance may fail to be created. Contact your organization administrator to learn more about tag policies.
   	Required Duration	1	Select the validity period of DBSS. After you select Auto-renew, the system automatically renews the instance upon expiry if your account balance is sufficient. You can continue to use the instance.

5. Confirm the configuration and click Next.

   For any doubt about the pricing, click Pricing details to understand more.

6. On the Details page, read the Database Security Service Statement, select I have read and agree to the Database Security Service Statement, and click Submit.
7. On the displayed page, select a payment method.
8. After you pay for your order, you can view the creation status of your instances.

Step 2: Add a Database

Databases audited by DBSS support agent-free installation and agent installation. Table 2 lists the types and versions of databases that support agent-free installation. Table 3 lists the types and versions of databases that support agent installation. You can enable database audit without installing an agent or by installing an agent based on the database type and version.

Adding a Database Without Installing an Agent

1. In the navigation tree on the left, choose Databases.
2. In the Instance drop-down list, select the instance whose database is to be added.
3. Click Add Database.
4. In the displayed dialog box, set the database parameters.
5. Click OK. A database whose Audit Status is Disabled is added to the database list.

Adding a Database By Installing an Agent

1. Add a database.
   1. In the navigation tree on the left, choose Databases.
   2. In the Instance drop-down list, select the instance whose database is to be added.
   3. Click Add Database.
   4. In the displayed dialog box, set the database parameters.
   5. Click OK. A database whose Audit Status is Disabled is added to the database list.

2. Add an agent.
   1. In the navigation tree on the left, choose Databases.
   2. In the Instance drop-down list, select the instance whose agent is to be added.
   3. In the Agent column of the desired database, click Add.
   4. In the displayed dialog box, select an add mode.
   5. Click OK.

3. Download and install an agent.
   1. In the navigation tree on the left, choose Databases.
   2. In the Instance drop-down list, select the instance whose agent is to be downloaded.
   3. Click in the lower part of the database list to expand the agent details. Locate the target agent and click Download Agent in the Operation column The agent installation package will be downloaded.
   4. Install an agent.
      1. Upload the downloaded agent installation package xxx.tar.gz to the node (for example, using WinSCP).
      2. Log in to the node as user root using SSH through a cross-platform remote access tool (for example, PuTTY).
      3. Run the following command to access the directory where the agent installation package xxx.tar.gz is stored:

         cd Directory_containing_agent_installation_package

      4. Run the following command to decompress the installation package xxx.tar.gz:

         tar -xvf xxx.tar.gz

      5. Run the following command to switch to the directory containing the decompressed files:

         cd Decompressed_package_directory

      6. Run the following command to install the agent:

         sh install.sh

      7. Run the following command to view the running status of the agent program:

         service audit_agent status

         If the following information is displayed, the agent is running properly:

         

         audit agent is running.

Step 3: Enabling Database Audit

1. Enable database audit.
   1. In the navigation tree on the left, choose Databases.
   2. Select a database audit instance from the Instance drop-down list.
   3. In the database list, click Enable in the Operation column of the database you want to audit.

      The Audit Status of the database is Enabled. You do not need to restart the database.

2. Verify the audit result.
   1. Run an SQL statement (for example, show databases) in the target database.
   2. In the navigation tree on the left, choose Data Reports. The Data Reports page is displayed.
   3. In the Instance drop-down list, select the instance that audits the target database.
   4. Click the Statements tab.
   5. Click on the right of Time, select the start time and end time, and click Submit. The SQL statement entered in Figure 1 is displayed in the list.
      Figure 1 Viewing SQL statements
      

Related Operations

To effectively audit the database, you can customize audit rules and view audit results and monitoring information. This helps you locate internal violations and improper operations and ensure data asset security. For details, see Configuring Audit Rules , Viewing Audit Results , and Viewing Monitoring Information .