View session logs-Data Security Center(DSC)-阿里云帮助中心

Session logs record sessions between clients and servers. This topic shows you how to view session logs in the Database Audit console and the Log Service console.

View session logs in the Database Audit console

Log on to the Database Audit console.
In the left-side navigation pane, choose Query and Analysis > Session Logs.
Select search criteria, such as an asset and a time range, and then click Search.
Note
A single query can return up to 10,000 records.
On the Session Logs page, view the results.
Optional: In the Actions column for a session, click Details.

View session logs in the Log Service console

Log Service stores database operation logs that are audited by Database Audit. The session logs in the Database Audit console come from Log Service. You can view and download session log data from the Projects and Logstores that are created by Database Audit in the Log Service console.

Procedure

Log on to the Log Service console.
In the Project list, find the Project associated with Database Audit and click its name.
You can identify Projects created by Database Audit by their comment: "Created by Database Audit. Do not delete."
On the Logstores page, click the name of the target Logstore.
Session logs are stored in Logstores whose names start with dbaudit-session.
On the details page of the target Logstore, select a time range and view the log details.
For more information about the session log fields, see Log fields.

Log fields

Field	Description
a	The session ID.
b	The database type.
c	The client IP address.
d	The client port.
e	The database IP address.
f	The database port.
g	The client MAC address.
h	The database MAC address.
i	The logon account.
iid	The ID of the Database Audit instance.
j	The client tool.
k	The client hostname.
l	The operating system username.
m	The database name or the system identifier (SID) of the instance.
n	The session status. Valid values: -1: Unknown 0: Logon failed 1: Logon successful
o	The number of SQL statements.
p	The total request traffic for the session.
q	The total response traffic for the session.
r	The session start time.
s	The session end time.
t	String information, such as the runtime environment and protocol version.
u	The character encoding.
uid	The ID of your Alibaba Cloud account.
v	Indicates whether connection information exists at the communication protocol layer. Valid values: 0: No 1: The source is parsed correctly. 2: The source is obtained from self-learning or persistence.
w	Indicates whether the session ended normally.
x	The number of SQL statements that are filtered out.