Call DescribeAuditLogRecords to query SQL audit logs - AnalyticDB - Alibaba Cloud - AnalyticDB

Queries the SQL audit logs of an AnalyticDB for MySQL Data Warehouse Edition cluster.

Operation description

Before you invoke this operation to query the SQL audit logs of an AnalyticDB for MySQL cluster, enable SQL audit. You can invoke the DescribeAuditLogConfig operation to query the enabling status of SQL audit. If SQL audit is disabled, invoke the ModifyAuditLogConfig operation to enable SQL audit.

SQL audit logs can be queried only when SQL audit is enabled, and only logs from the last 30 days are supported. If SQL audit is shutdown and then re-enabled, only logs generated after re-enabling can be queried. SQL audit logs do not record INSERT INTO VALUES, REPLACE INTO VALUES, or UPSERT INTO VALUES operations.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

adb:DescribeAuditLogRecords

get

DBCluster

acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}

None

Request parameters

Parameter	Type	Required	Description	Example
DBClusterId	string	Yes	The ID of the Data Warehouse Edition cluster. Note You can call the DescribeDBClusters operation to query the IDs of all Data Warehouse Edition clusters in a region.	am-t4nj8619bz2w3****
RegionId	string	Yes	The region ID. Note You can call the DescribeRegions operation to query the regions and zones supported by AnalyticDB for MySQL, including region IDs.	cn-hangzhou
StartTime	string	No	The beginning of the time range to query. Specify the time in UTC in the yyyy-MM-ddTHH:mmZ format. Note SQL audit logs can be queried only when SQL audit is enabled, and only logs from the last 30 days are supported. If SQL audit is disabled and then re-enabled, only logs generated after re-enabling can be queried.	2022-01-23T02:18Z
EndTime	string	No	The end of the time range to query. Specify the time in UTC in the yyyy-MM-ddTHH:mmZ format. Note The end time must be later than the start time. The interval between the start time and the end time cannot exceed 24 hours.	2022-01-23T22:18Z
DBName	string	No	The name of the database on which the SQL statement was executed.	adb_demo
QueryKeyword	string	No	The keyword used to filter SQL statements that contain the specified keyword.	adb
SqlType	string	No	The type of the SQL statement. Valid values: DELETE SELECT UPDATE INSERT_INTO_SELECT ALTER DROP CREATE Note You can specify only one SQL type per request. If this parameter is not specified, all types are queried.	SELECT
Succeed	string	No	Specifies whether the SQL statement was executed successfully. Valid values: true: The SQL statement was executed successfully. false: The SQL statement failed to be executed.	true
HostAddress	string	No	The IP address and port number of the client that executed the SQL statement.	100.104.XX.XX:43908
OrderType	string	No	The order in which the results are sorted by SQL execution time. Valid values: asc: ascending order. desc: descending order.	asc
User	string	No	The username that was used to execute the SQL statement.	test_user
Order	string	No	The sorting order of the results based on specified fields. The value is in JSON format and is an ordered JSON array. Compound sorting is performed in the order of the input array. The array contains the Field and Type fields. Field specifies the field name for sorting. Valid values: HostAddress: the IP address of the client that connected to the database. Succeed: specifies whether the SQL statement was executed successfully. TotalTime: the total execution duration of the SQL statement. DBName: the name of the database on which the SQL statement was executed. SQLType: the type of the SQL statement. User: the username that was used to execute the SQL statement. ExecuteTime: the start time of the SQL statement execution. Type specifies the sorting type. Valid values: Desc: descending order. Asc: ascending order.	[{"Field":"ExecuteTime","Type":"Desc"},{"Field":"HostAddress","Type":"Asc"}]
PageSize	integer	No	The number of entries per page. Valid values: 10 30 50 100 Note If this parameter is not specified, the default value 10 is used.	10
PageNumber	integer	No	The page number. The value must be a positive integer that does not exceed the maximum value of the Integer data type. Default value: 1.	1
		No

Response elements

Element	Type	Description	Example
	object	The details.
TotalCount	string	The total number of entries returned.	1
PageSize	string	The number of entries per page.	10
RequestId	string	The request ID.	8A564B7F-8C00-43C0-8EC5-919FBB70573
PageNumber	string	The page number.	1
DBClusterId	string	The cluster ID.	am-t4nj8619bz2w3****
Items	array<object>	The SQL audit log details.
	object	The list.
HostAddress	string	The IP address and port number of the client that executed the SQL statement.	100.104.XX.XX:43908
Succeed	string	Indicates whether the SQL statement was executed successfully. Valid values: true: The SQL statement was executed successfully. false: The SQL statement failed to be executed.	true
SQLText	string	The SQL statement.	SELECT * FROM tb_courses
TotalTime	string	The execution duration of the SQL statement. Unit: milliseconds (ms).	216
ConnId	string	This parameter is invalid.	None
DBName	string	The name of the database on which the SQL statement was executed.	adb_test
SQLType	string	The type of the SQL statement.	SELECT
ProcessID	string	The task ID.	202106081752021720161662490345362390
User	string	The username that was used to execute the SQL statement.	test_user
ExecuteTime	string	The start time of the SQL statement execution in local time. The time is in the yyyy-MM-dd HH:mm:ss format.	2022-01-23 16:05:08
ExecuteTimestamp	integer

Examples

Success response

JSON format

{
  "TotalCount": "1",
  "PageSize": "10",
  "RequestId": "8A564B7F-8C00-43C0-8EC5-919FBB70573",
  "PageNumber": "1",
  "DBClusterId": "am-t4nj8619bz2w3****",
  "Items": [
    {
      "HostAddress": "100.104.XX.XX:43908",
      "Succeed": "true",
      "SQLText": "SELECT * FROM tb_courses",
      "TotalTime": "216",
      "ConnId": "无",
      "DBName": "adb_test",
      "SQLType": "SELECT",
      "ProcessID": "202106081752021720161662490345362390",
      "User": "test_user",
      "ExecuteTime": "2022-01-23 16:05:08",
      "ExecuteTimestamp": 0
    }
  ]
}

Error codes

HTTP status code	Error code	Error message	Description
404	InvalidDBCluster.NotFound	The DBClusterId provided does not exist in our records.	The specified DBClusterId parameter does not exist. Make sure that the DBClusterId value is valid.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.