Configuring the Database Audit Logs¶
Prerequisites¶
Database audit logs are configured on the Security Settings page. You can change security settings only when the cluster status is Available and Unbalanced, and Task Information cannot be Creating snapshot, Scaling out, Changing all specifications, Configuring, or Restarting.
Procedure¶
Log in to the GaussDB(DWS) management console.
Choose Clusters > Dedicated Cluster.
In the cluster list, click the name of a cluster. Choose Security.
By default, Configuration Status is Synchronized, which indicates that the latest database results are displayed.
In the Audit Settings area, set the audit items:
Note
The default audit log retention policy is space-first, which means audit logs will be automatically deleted when the size of audit logs on a single node exceeds 1 GB. This function prevents node faults or low performance caused by high disk space occupied by audit logs.
Table 1 describes the detailed information about the audit items.
Table 1 Audit items¶ Audit Item
Description
Unauthorized access
Specifies whether to record unauthorized operations. This parameter is disabled by default.
DML operations
Specifies whether to record INSERT, UPDATE, and DELETE operations on tables. This parameter is disabled by default.
SELECT operations
Specifies whether to record the SELECT operation. This parameter is disabled by default.
Stored procedure executions
Specifies whether to record operations when executing the stored procedure or user-defined functions. This parameter is disabled by default.
COPY operations
Specifies whether to record the COPY operation. This parameter is disabled by default.
DDL operations
Specifies whether to record the CREATE, DROP, and ALTER operations of specified database objects. DATABASE, SCHEMA, and USER are selected by default.
Except the audit items listed in Table 1, key audit items in Table 2 are enabled by default on GaussDB(DWS).
Table 2 Key audit items¶ Parameter
Description
Key audit items
Records successful and failed logins and logout.
Records database startup, stop, recovery, and switchover.
Records user locking and unlocking.
Records the grants and reclaims of user permissions.
Records the audit function of the SET operation.
Enable or disable audit log dumps.
For more information, see Enabling Audit Log Dumps.
Click Apply.
Click
. The configuration status Applying indicates that the configurations are being saved.
When the status changes to Synchronized, the configurations are saved and take effect.