The audit log feature allows you to query all audit data. This topic describes how to view these logs in the Database Audit and Log Service consoles.
View logs in the Database Audit console
- Log on to the Database Audit console.For more information, see Log on to the Database Audit console.
In the left-side navigation pane, choose .
Set filter conditions, such as the asset name and time range, and then click Query.
Other filter conditions include SQL keyword, client IP, database user, and execution result. The query results include columns such as SQL statement, capture time, client IP, database user, affected rows, response time (μs), execution result, and session logon time.
Click an entry in the SQL statement column to view the statement details.
View logs in the Log Service console
Database Audit stores all audited database operation logs in Log Service. The audit logs in the Database Audit console are sourced from Log Service. You can then view and download this data from the Projects and Logstores that Database Audit creates in the Log Service console.
Procedure
Log on to the Log Service console.
In the Project list, find the Project for Database Audit and click its name.
Projects created by Database Audit use the name format
dbaudit-<database_instance_name>. Use this format to find the correct Project.On the Logstores page, click the name of the target Logstore.
Logstores with names starting with
dbaudit-logcontain audit logs.On the details page of the Logstore, select a time range and view the log details.
For a detailed description of the audit log fields, see the following section.
Log fields
Parameter | Description |
uid | The Alibaba Cloud account ID. |
iid | The ID of the Database Audit instance. |
sq | The statement ID. |
di | The database ID. |
si | The session ID. |
dm | The schema name. |
tx | The content of the SQL statement. |
ti | The statement template. |
tm | The time when the statement was captured. |
tl | The risk level. Valid values:
|
rd | Indicates whether an alert is generated. Valid values:
|
rc | The database response code. |
rt | The database response message. |
rw | The number of affected rows. |
ec | The response time, in microseconds (μs). |
fc | The total time consumed by the statement, in microseconds (μs). |
ap | The application's client IP address. |
am | The application user. |
ri | The ID of the matched rule. |
rp | The risk type. Valid values:
|
cp | The client IP address. |
um | The database username. |
st | A number that represents the SQL statement type. For the mappings between st field values and SQL statement types, see st field values and SQL statement types. |
dp | The IP address of the database. |
dt | The database port. |
pm | The tool or application. |
bi | Deprecated. You can ignore this field. |
om | The operating system (OS) user. |
im | The service (instance) name. |
rs | The result set returned after the statement is executed. |
st field values and SQL statement types
st field value | SQL statement type |
1 | CREATE |
2 | SET |
4 | INSERT |
8 | SELECT |
16 | UPDATE |
32 | DELETE |
64 | DROP |
128 | ALTER |
512 | EXPLAIN |
1024 | GRANT |
2048 | REVOKE |
8192 | LOCK |
32768 | RENAME |
65536 | COMMENT |
131072 | AUDIT |
262144 | NOAUDIT |
524288 | COMMIT |
1048576 | ROLLBACK |
2097152 | SAVEPOINT |
4194304 | TRUNCATE |
8388608 | ASSOCIATE |
16777216 | DISASSOCIATE |
33554432 | CALL |
67108864 | ANALYZE |
134217728 | MERGE |
268435456 | BEGIN |
536870912 | DECLARE |
0 | INVALID SQL |
256 | FLASHBACK |
4096 | PURGE |
2251799813685248 | EXPDP |
2199023255552 | OTHER |
549755813888 | ADD |
4398046511104 | EXECUTE |
1073741824 | EXECUTE AS |
2147483648 | SETUSER |
4294967296 | REVERT |
8589934592 | USE |
17179869184 | BACKUP |
34359738368 | DISABLE TRIGGER |
68719476736 | ENABLE TRIGGER |
137438953472 | DBCC |
274877906944 | KILL |
1099511627776 | DENY |
8796093022208 | UPDATE STATISTICS |
17592186044416 | RESTORE |
16384 | MULTI SQL |
281474976710656 | TRANSFER |
35184372088832 | REPLACE |
140737488355328 | SHOW |
562949953421312 | DATABASE |
70368744177664 | LOAD |
536870912 | DECLARE CURSOR |
1125899906842624 | INSERT OR UPDATE |
4398046511104 | EXEC |
4503599627370496 | PUT |
9007199254740992 | APPEND |
32768 | RENAME |