Skip to content

Commit 534e4ce

Browse files
leto-bbqleto-bbq
authored
add slow operation tp auditlog from 2082 (#1001)
1 parent 7be1633 commit 534e4ce

15 files changed

Lines changed: 289 additions & 138 deletions

File tree

‎src/UserGuide/Master/Table/Reference/System-Config-Manual.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@ redirectTo: System-Config-Manual_apache.html
2121
under the License.
2222
2323
-->
24+

‎src/UserGuide/Master/Table/User-Manual/Audit-Log_timecho.md‎

Lines changed: 35 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -24,29 +24,34 @@
2424

2525
## 1. Introduction
2626

27-
Audit logs provide a documented record of database activities. Through the audit log feature, you can track operations like data creation, deletion, modification, and querying to ensure information security. IoTDB's audit log functionality supports the following features:
27+
Audit logs serve as the record credentials of a database, enabling tracking of various operations (e.g., create, read, update, delete) to ensure information security. The audit log feature in IoTDB supports the following capabilities:
2828

29-
* Configurable enable/disable of audit logging
30-
* Configurable auditable operation types and privilege levels
31-
* Configurable audit log retention periods using TTL (time-based rolling) and SpaceTL (space-based rolling)
32-
* Default encryption storage for audit logs
29+
* Supports enabling/disabling the audit log functionality through configuration
30+
* Supports configuring operation types and privilege levels to be recorded via parameters
31+
* Supports setting the storage duration of audit log files, including time-based rolling (via TTL) and space-based rolling (via SpaceTL)
32+
* Supports configuring parameters to count slow requests (with write/query latency exceeding a threshold, default 3000 milliseconds) within any specified time period
33+
* Audit log files are stored in encrypted format by default
3334

34-
> Note: This feature is available from version V2.0.8 onwards.
35+
> Note: This feature is available from version V2.0.8-beta onwards.
3536
3637
## 2. Configuration Parameters
3738

3839
Edit the `iotdb-system.properties` file to enable audit logging using the following parameters:
3940

40-
| Parameter Name | Description | Data Type | Default Value | Application Method |
41-
|---------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|----------------------------|--------------------|
42-
| `enable_audit_log` | Enable audit logging. true: enabled. false: disabled. | Boolean | false | Restart Required |
43-
| `auditable_operation_type` | Operation type selection. DML: All DML operations; DDL: All DDL operations; QUERY: All queries; CONTROL: All control statements; | String | DML,DDL,QUERY,CONTROL | Restart Required |
44-
| `auditable_operation_level` | Privilege level selection. global: Record all audit logs; object: Only record audit logs for data instances; Containment relationship: object < global. | String | global | Restart Required |
45-
| `auditable_operation_result` | Audit result selection. success: Only record successful events; fail: Only record failed events; | String | success, fail | Restart Required |
46-
| `audit_log_ttl_in_days` | Audit log TTL (Time To Live) in days. Logs older than this threshold will expire. | Double | -1.0 (never deleted) | Restart Required |
47-
| `audit_log_space_tl_in_GB` | Audit log SpaceTL in GB. When total audit log size exceeds this threshold, log rotation starts deleting oldest files. | Double | 1.0 | Restart Required |
48-
| `audit_log_batch_interval_in_ms` | Batch write interval for audit logs in milliseconds | Long | 1000 | Restart Required |
49-
| `audit_log_batch_max_queue_bytes` | Maximum queue size in bytes for batch processing audit logs. Subsequent writes will be blocked when queue exceeds this value. | Long | 268435456 | Restart Required |
41+
| Parameter Name | Description | Data Type | Default Value | Activation Method |
42+
|-------------------------------------------|------------------------------------------------------------------------------------------------------------|-----------|-------------------------------|-------------------|
43+
| `enable_audit_log` | Whether to enable audit logging. true: enabled. false: disabled. | Boolean | false | Hot Reload |
44+
| `auditable_operation_type` | Operation type selection. DML: all DML operations are logged; DDL: all DDL operations are logged; QUERY: all query operations are logged; CONTROL: all control statements are logged. | String | DML,DDL,QUERY,CONTROL | Hot Reload |
45+
| `auditable_dml_event_type` | Event types for auditing DML operations. `OBJECT_AUTHENTICATION`: object authentication, `SLOW_OPERATION`: slow operation | String | `OBJECT_AUTHENTICATION`,`SLOW_OPERATION` | Hot Reload |
46+
| `auditable_ddl_event_type` | Event types for auditing DDL operations. `OBJECT_AUTHENTICATION`: object authentication, `SLOW_OPERATION`: slow operation | String | `OBJECT_AUTHENTICATION`,`SLOW_OPERATION` | Hot Reload |
47+
| `auditable_query_event_type` | Event types for auditing query operations. `OBJECT_AUTHENTICATION`: object authentication, `SLOW_OPERATION`: slow operation | String | `OBJECT_AUTHENTICATION`,`SLOW_OPERATION` | Hot Reload |
48+
| `auditable_control_event_type` | Event types for auditing control operations. `CHANGE_AUDIT_OPTION`: audit option change, `OBJECT_AUTHENTICATION`: object authentication, `LOGIN`: login, `LOGOUT`: logout, `DN_SHUTDOWN`: data node shutdown, `SLOW_OPERATION`: slow operation | String | `CHANGE_AUDIT_OPTION`,`OBJECT_AUTHENTICATION`,`LOGIN`,`LOGOUT`,`DN_SHUTDOWN`,`SLOW_OPERATION` | Hot Reload |
49+
| `auditable_operation_level` | Permission level selection. global: log all audit events; object: only log events related to data instances. Containment relationship: object < global. For example: when set to global, all audit logs are recorded normally; when set to object, only operations on specific data instances are recorded. | String | global | Hot Reload |
50+
| `auditable_operation_result` | Audit result selection. success: log only successful events; fail: log only failed events | String | success,fail | Hot Reload |
51+
| `audit_log_ttl_in_days` | Audit log TTL (Time To Live). Logs older than this threshold will expire. | Double | -1.0 (never deleted) | Hot Reload |
52+
| `audit_log_space_tl_in_GB` | Audit log SpaceTL. Logs will start rotating when total space reaches this threshold. | Double | 1.0 | Hot Reload |
53+
| `audit_log_batch_interval_in_ms` | Batch write interval for audit logs | Long | 1000 | Hot Reload |
54+
| `audit_log_batch_max_queue_bytes` | Maximum byte size of the queue for batch processing audit logs. Subsequent write operations will be blocked when this threshold is exceeded. | Long | 268435456 | Hot Reload |
5055

5156
## 3. Access Methods
5257

@@ -120,4 +125,18 @@ IoTDB:__audit> select time,database,operation_type,log from audit_log where res
120125
+-----------------------------+--------+--------------+----------------------------------------------------------------------+
121126
Total line number = 1
122127
It costs 0.011s
128+
```
129+
130+
131+
* Query audit event records with types 'slow operation' and 'login'
132+
133+
```SQL
134+
IoTDB:__audit> select * from audit_log where audit_event_type='SLOW_OPERATION' or audit_event_type='LOGIN' limit 1
135+
+-----------------------------+-------+-------+--------+------------+----------------+--------------+--------------+---------------+------+--------+----------+----------------------------------------------------------------------+
136+
| time|node_id|user_id|username|cli_hostname|audit_event_type|operation_type|privilege_type|privilege_level|result|database|sql_string| log|
137+
+-----------------------------+-------+-------+--------+------------+----------------+--------------+--------------+---------------+------+--------+----------+----------------------------------------------------------------------+
138+
|2026-01-23T11:47:42.136+08:00| node_1| u_none| user1| 127.0.0.1| LOGIN| CONTROL| null| GLOBAL| false| | |User user1 (ID=-1) login failed with code: 804, Authentication failed.|
139+
+-----------------------------+-------+-------+--------+------------+----------------+--------------+--------------+---------------+------+--------+----------+----------------------------------------------------------------------+
140+
Total line number = 1
141+
It costs 0.033s
123142
```

‎src/UserGuide/Master/Tree/Reference/Common-Config-Manual.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -707,7 +707,7 @@ Different configuration parameters take effect in the following three ways:
707707
|:---:|:----------------------------------------|
708708
|Description| Time cost(ms) threshold for slow query. |
709709
|Type| Int32 |
710-
|Default| 10000 |
710+
|Default| 3000 |
711711
|Effective| Trigger |
712712

713713
* query\_timeout\_threshold

0 commit comments

Comments
 (0)