审计日志用于监视用户所执行的数据库操作,记录的主要内容有:
•
用户登录方式(CAPI、ODBC、JDBC、ADO)
•
返回结果集(行数、执行时间)
•
登录的用户和IP
•
开始执行时间
•
执行的sql 语句
$GCLUSTER_BASE/log/gcluster 下audit_log
另外可以使用如下配置方式,设定审计日志存储在系统表中:
全局级变量:
SET GLOBAL log_output = 'table';
•
示例:使用系统表查看审计日志
GBase 8a MPP Cluster 产品手册
5 数据库管理指南
文档版本953(2022-09-15)
南大通用数据技术股份有限公司
1332
gbase> SELECT start_time,user_host,query_time,rows,LEFT(sql_text, 30),
conn_type FROM gbase.audit_log;
+---------------------+----------------------------------+
| start_time
| user_host
|
+---------------------+----------------------------------+
| 2013-10-09 17:21:08 | root[root] @ localhost []
|
| 2013-10-09 17:21:22 | root[root] @
[192.168.10.116]
|
| 2013-10-09 17:21:22 | root[root] @ localhost []
|
| 2013-10-09 17:21:32 | gbase[gbase] @
[192.168.10.116] |
| 2013-10-09 17:21:32 | root[root] @ localhost []
|
| 2013-10-09 17:21:32 | root[root] @ localhost []
|
| 2013-10-09 17:21:45 | root[root] @ localhost []
|
| 2013-10-09 17:21:52 | root[root] @ localhost []
|
| 2013-10-09 17:21:58 | root[root] @ localhost []
|
| 2013-10-09 17:22:05 | root[root] @ localhost []
|
| 2013-10-09 17:22:10 | gbase[gbase] @
[192.168.10.116] |
| 2013-10-09 17:22:10 | root[root] @ localhost []
|
| 2013-10-09 17:22:17 | root[root] @ localhost []
|
+---------------------+----------------------------------+
+-----------------+------+-------------------------------+----------+
| query_time
| rows | LEFT(sql_text, 30)
| conn_type|
+-----------------+------+-------------------------------+----------+
| 00:00:00.006397 |
0 | SET GLOBAL log_output = 'table| CAPI
|
| 00:00:00.000282 |
0 | Connect
| CAPI
|
| 00:00:00.025018 |
0 | DROP USER tzt
| CAPI
|
| 00:00:00.000054 |
0 | Connect
| CAPI
|
| 00:00:00.000175 |
0 | DROP DATABASE test
| CAPI
|
| 00:00:00.111946 |
1 | SELECT DATABASE()
| CAPI
|
| 00:00:00.000086 |
0 | CREATE USER tzt identified by | CAPI
|
| 00:00:00.439480 |
0 | GRANT ALL ON *.* TO tzt@'%'
| CAPI
|
| 00:00:00.000387 |
0 | CREATE DATABASE test
| CAPI
|
| 00:00:00.000025 |
0 | USE test
| CAPI
|
| 00:00:00.000384 |
0 | Connect
| CAPI
|
| 00:00:00.000144 |
0 | CREATE TABLE t1(i int)
| CAPI
|
| 00:00:00.004527 |
2 | INSERT INTO t1 VALUES (1),(2) | CAPI
|
+-----------------+------+-------------------------------+----------+
13 rows in set
注:
gccli 连接集群时如果不带h 参数,
默认使用UDS
(unix domain socket)
连接,
不使用IP 和PORT,所以记录审计日志时user_host 和host_ip 中ip 记录为空。
GBase 8a MPP Cluster 产品手册
5 数据库管理指南
文档版本953(2022-09-15)
南大通用数据技术股份有限公司
1333