The audit log feature lets you query all audit data. This topic describes how to query audit logs in Database Audit and the Log Service console.
View audit logs in Database Audit
Step 1: Log on to Database Audit
Log on to the Database Audit system. For more information, see Log on to the Database Audit system.
In the left-side navigation pane, choose .
Step 2: Set query conditions
Set query conditions on the Audit Logs tab of the Audit Logs page.
Select a time range.
Specify keywords for the packet.
To use multiple keywords, separate them with commas (,) or spaces. Commas act as an OR operator, and spaces act as an AND operator.
Set more search criteria.
The Audit Logs page displays common filter conditions by default. To use more filter conditions, click More, and then select and configure the conditions that you need. The following table describes the supported filter conditions.
NoteFilter conditions are combined with an AND operator.
(Optional) Save the query conditions.
To save the query conditions, click Save.
Saved conditions can be selected from the drop-down list for future queries.
Click the
icon. In the Set Displayed Columns dialog box, select the columns you want to display in the results, and then click OK.Click Search to run the query.
NoteYou can query up to 10,000 records at a time.
After the query completes, you can view the results in the Log List.
Step 3: View audit log details
View details
In the Log List, click Details in the Actions column. On the Audit Log Details page, you can view information such as Basic information, Client, Server, Request, Response, and Association information.
Set an alias
Set client IP alias
Click Set Alias next to Client IP address.
On the Add IP Alias page, enter a Name, IP/Network, and Note, and then click Save.
On the Auxiliary Function page, you can view the list of IP aliases on the IP Alias tab.
Set database account alias
Click Set Alias next to Database account.
On the Add Account Alias page, enter a Name, Asset, Database account, and Note, and then click Save.
On the Auxiliary Function page, you can view the list of account aliases on the Account Alias tab.
SQL template filtering
On the SQL template tab in the Request section, view the SQL template for the packet. Click Filter This Template to add the SQL template to the filter conditions. Click Do Not Filter This Template to remove it from the filter conditions. For more information, see SQL template filtering.
C/S application user identification
At the bottom of the Audit Log Details page, click Extract C/S app username.
In the Add C/S application identification configuration dialog box, select an SQL template and Parameter Position, and then click OK.
After you configure C/S application user identification, the system adds the configuration to the C/S application user identification list. For more information, see C/S application user identification.
Forensics
At the bottom of the Audit Log Details page, click Forensics.
In the Download dialog box, click Download to download the complete details page for this audit log entry.
Click Previous or Next to navigate to the adjacent audit log entry.
View audit logs in the Log Service console
Database Audit stores audited database operation logs in Log Service. The logs you query in Database Audit originate from Log Service, but you can also view and download them directly from the Projects and Logstores that are created by Database Audit in the Log Service console.
Procedure
Log on to the Log Service console.
In the Project list, find the Project related to Database Audit and click its name.
Projects created by Database Audit have the following comment:
Created by Database Audit. Do not delete.You can use this comment to locate the relevant Project.On the Logstores page, click the name of the target Logstore.
Logstores whose names start with
dbaudit-auditstore audit logs.On the details page of the target Logstore, select a time range and view the log details.
For detailed descriptions of the log fields, see Log field reference.