Query the audit logs of an instance by filter condition-Tair (Redis® OSS-Compatible)(Tair)-阿里云帮助中心

Audit logs record data write, modification, and deletion operations on your Tair (Redis OSS-compatible) instance (read operations are not logged). Use them to investigate unexpected resource spikes, track data changes, or troubleshoot access issues.

Audit logs may include records of internal system operations. These records are not external access attempts and require no action:

aurora account: A backend system account used by Tair (Redis OSS-compatible) to perform system maintenance operations such as backups and monitoring. This account is not exposed to users, so its appearance in audit logs is normal system behavior.
DB node host IP: An IP address outside your whitelist that appears in audit logs may be the host IP of a DB node. This reflects an internal system operation, not external access.

The console displays a maximum of 2,000 log entries. To query larger result sets, use the Simple Log Service console.

Precautions

Audit logs record only write operations (such as SET, DEL, and HSET) and do not record read operations (such as GET and HGET).
Enabling audit logs may impact instance performance by 5%–15%. For more information, see Audit Logs Overview.

Prerequisites

Before you begin, ensure that you have the audit log feature enabled on the instance.

Grant RAM user permissions

Skip this section if you log in with your Alibaba Cloud root account.

RAM users who access audit logs must have Simple Log Service management permissions. Grant one of the following:

AliyunLogFullAccess system policy — grants access to all Logstores. See Grant permissions.

A custom policy scoped to Tair (Redis OSS-compatible) audit logs only:

{
  "Version": "1",
  "Statement": [
    {
      "Action": "log:*",
      "Resource": "acs:log:*:*:project/nosql-*",
      "Effect": "Allow"
    }
  ]
}

View audit logs

Log on to the Instances page. In the top navigation bar, select the region where the instance is deployed. Find the instance and click its ID.
In the left-side navigation pane, choose Logs > Audit Logs.
On the Audit Logs page, review the log entries for the instance.

Filter logs

Use filter conditions to narrow down log records.

Go to the Audit Logs page for your instance (see View audit logs).
In the filter section, set one or more of the following conditions:

Filter condition	Description
Keyword	Filter by client IP address, command, account, or other extended fields. Enter the complete value — partial matches are not supported. For example, enter `192.168.*.1` (not `192.168`), or `AUTH` (not `au`). If the keyword contains a colon (`:`), enclose it in double quotation marks, for example, `"userId:1"`.
Type	`redis_audit_log` — logs from data shards. `redis_proxy_audit_log` — logs from proxy servers. Available only for instances using cluster architecture in proxy mode or read/write splitting architecture. For these instances, the default client address is the proxy IP. To retrieve the original client IP, set the `ptod_enabled` parameter to `1`. See Configuration Parameters Overview.
Account	The account used to connect to the instance. The default account appears as `null`.
Client IP	The IP address of the client connecting to the instance.
DB	The database whose logs you want to query.

Query logs by time range

Go to the Audit Logs page for your instance (see View audit logs).
Click Select Time Range and specify the time range.

API reference

API	Description
ModifyAuditLogConfig	Enable or disable audit logs and set the log retention period.
DescribeAuditLogConfig	Query audit log configuration, including whether audit logs are enabled and the retention period.
DescribeAuditRecords	Query the audit logs of an instance.

Billing

After enabling audit logs, you are charged based on audit log storage usage. For billing details, see Billing items.

FAQ

Can I view more than 2,000 audit log entries?

The console shows up to 2,000 entries. For larger queries, log on to the Simple Log Service console and query the Logstore directly.

How do I check the storage space used by audit logs?

Open the Instances page in the console and go to the Audit Logs page for the instance. The storage usage is displayed there.

Why do some logs show a client IP of 127.0.0.1?

Entries with the IP address 127.0.0.1 are generated by internal management operations, not by external clients. The following table lists common internal log types:

Log type	Description
Primary node eviction	Eviction occurred on the node.
Primary node audit log drop event	An audit log drop event started (drop start).
Primary node audit log drop event	An audit log drop event ended (drop end).
Primary node hot key log	Hot keys detected on the node, identified by QPS (queries per second) or traffic.
Primary node large key log	Large keys detected on the node, identified by number of elements.

Can audit logs show when a key was deleted, which keys were most recently set, or when an account logged on?

If audit logging was enabled before a key was deleted, you can query its deletion time and the source IP address of the operation. The console cannot directly show which keys were most recently set. To trace write requests, enable audit logging before those requests occur. Audit logging is a paid feature, and charges accrue based on audit log storage usage. It records only operations performed after it is enabled and cannot retrieve historical operations.

Redis does not record account logon times. After audit logging is enabled, you can view write operations performed by each account during the enabled period.

Does the client IP address in audit logs represent the actual client IP, and can I distinguish application operations from manual operations?

Audit logs record only the client's public egress IP address. If the client connects through a VPN, the logs record the VPN's public egress IP address instead of the client's actual IP address. Audit logs cannot collect information about the underlying client device.

Note

The database records only the source IP address of an operation. It cannot determine whether a command such as FLUSHDB was triggered automatically by an application or run manually. Use the IP address attribution together with your application logs to identify the source.