审计日志配置

Datalayers 提供数据库操作审计能力，可记录用户对数据库的查询、修改等操作。审计日志以文件形式存储，便于后续查询与分析。

配置示例

# Optional audit log settings.
# [audit]

# The directory to store audit log files.
# Relative paths are resolved against `base_dir`.
# Default: "audit".
# path = "audit"

# The fixed time period for switching to a new log file.
# Supported rotation values:
# - "MINUTELY" or "M".
# - "HOURLY" or "H".
# - "DAILY" or "D".
# Default: "DAILY".
# rotation = "DAILY"

# Optional. Maximum reserved count of log rolling files.
# Value rule:
#   Unset / set to 0 → Unlimited, keep forever
#   Positive integer N → Keep at most N rolling log files
# Default: Unlimited, keep forever.
# max_files = 30

# Supported kinds of audit logs, separated by comma.
# Kind list: "dml", "ddl", "dql", "admin", "misc"
# "all" means all kinds could be logged.
# Default: "ddl,admin"
# kinds = "ddl,admin"

# Supported actions of audit logs, separated by comma.
# Action list: "select", "insert", "update", "delete", "create", "alter", "drop", "truncate", "trim",
#   "desc", "show", "create_user", "drop_user", "set_password", "grant", "revoke",
#   "flush", "cluster", "migrate", "compact", "export", "misc",
# "all" means all actions could be logged.
# Default: "all"
# actions = "all"

# Exclude actions of audit logs, separated by comma.
# Optional value is the same as `actions`.
# Default: "select,insert"
# excludes = ""

配置说明

• path: 指定日志存储路径，支持相对路径（基于 base_dir）或绝对路径
• max_files: 控制日志文件轮转数量，避免磁盘空间过度占用
• kinds: 精细化控制需要记录的日志类型，减少不必要的日志记录
• actions: 根据实际安全需求，选择需要审计的具体数据库操作
• excludes: 根据实际安全需求，选择排除不需要记录的操作类型
• 同时满足 kinds 和 actions 且不在 excludes 条件的日志才会被记录

操作约束

操作	kind	action
INSERT	dml	insert
UPDATE	dml	update
DELETE	dml	delete
SELECT	dql	select
DESC TABLE	dql	desc
SHOW	dql	show
CREATE ROLE	admin	create_user
CREATE USER	admin	create_user
DROP ROLE	admin	drop_user
DROP USER	admin	drop_user
GRANT	admin	grant
REVOKE	admin	revoke
SET PASSWORD	admin	set_password
CREATE DATABASE	ddl	create
DROP DATABASE	ddl	drop
TRIM DATABASE	ddl	trim
CREATE TABLE	ddl	create
DROP TABLE	ddl	drop
ALTER TABLE	ddl	alter
TRUNCATE TABLE	ddl	truncate
CREATE INDEX	ddl	alter
DROP INDEX	ddl	alter
FLUSH	admin	flush
COMPACT	admin	compact
EXPORT	admin	export
EXCLUDE NODE	admin	cluster
INCLUDE NODE	admin	cluster
DROP NODE	admin	cluster
REBALANCE	admin	migrate
STOP MIGRATION	admin	migrate

注意事项

• 当前审计日志功能暂不支持记录 SELECT 和 INSERT 语句的相关操作。
• 审计日志会在语句执行前进行记录，不包含语句执行状态信息。如需查看语句是否执行成功或出现异常，请在常规日志中进一步查询。