Use DescribeAuditLogRecords to query SQL audit logs - AnalyticDB

Queries the SQL audit logs for a cluster.

Operation description

You can query SQL audit logs only if SQL Audit is enabled. You can retrieve SQL audit logs generated within the last 30 days. If you disable and then re-enable SQL Audit, you can retrieve only logs generated after SQL Audit is re-enabled. SQL audit logs do not record INSERT INTO VALUES, REPLACE INTO VALUES, or UPSERT INTO VALUES operations.
For the endpoints of this service, see Endpoints.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

adb:DescribeAuditLogRecords

list

*DBClusterLakeVersion

acs:adb:{#regionId}:{#accountId}:dbcluster/{#DBClusterId}

None

Request parameters

Parameter	Type	Required	Description	Example
DBClusterId	string	Yes	Cluster ID for the Enterprise Edition, Basic Edition, or Data Lakehouse Edition. Note You can call the DescribeDBClusters operation to list all cluster IDs in the destination region.	amv-t4nj8619bz2w3****
RegionId	string	Yes	The region ID. Note Call the DescribeRegions operation to query the region ID of the cluster.	cn-hangzhou
StartTime	string	No	The start of the time range to query. Specify the time in the yyyy-MM-ddTHH:mmZ format. The time must be in UTC. Note You can query SQL audit logs only when SQL Audit is enabled. You can query SQL audit logs that are generated within the last 30 days. If you disable and then re-enable SQL Audit, you can query only the logs that are generated after SQL Audit is re-enabled.	2022-08-12T04:17Z
EndTime	string	No	The end of the time range to query. Specify the time in the yyyy-MM-ddTHH:mmZ format. The time must be in UTC. Note The end time must be later than the start time. The time range between the start time and the end time cannot exceed 24 hours.	2022-08-12T17:08Z
DBName	string	No	The name of the database on which the SQL statement was executed.	adb_demo
QueryKeyword	string	No	A string that is used as a keyword to search for in the results.	adb
SqlType	string	No	The SQL statement type. Valid values: DELETE SELECT UPDATE INSERT INTO SELECT ALTER DROP CREATE Note You can query logs for only one type of SQL statement at a time. If you do not set this parameter, logs for all types of SQL statements are queried.	SELECT
Succeed	string	No	Indicates whether the SQL statement was successfully executed. Valid values: true: The statement was successfully executed. false: The statement failed to be executed.	true
HostAddress	string	No	The IP address and port number of the client that is used to execute the SQL statement.	100.104.XX.XX:43908
OrderType	string	No	The order in which to sort the retrieved entries by the execution time of the SQL statement. Valid values: asc: ascending order. desc: descending order.	asc
User	string	No	The username that is used to execute the SQL statement.	test
Order	string	No	The order in which to sort the retrieved entries by field. Specify the order as a JSON array of key-value pairs. Entries are sorted based on the order of the key-value pairs in the array. Each key-value pair consists of a `Field` and a `Type`. Example: `[{"Field":"ExecutionStartTime","Type":"Desc"},{"Field":"ScanRows","Type":"Asc"}]`. `Field`: the field by which to sort the retrieved entries. Valid values: HostAddress: the IP address of the client that connects to the database. UserName: the username. ExecutionStartTime: the start time of the SQL statement execution. QueryTime: the execution duration of the SQL statement. PeakMemoryUsage: the peak memory usage for executing the SQL statement. ScanRows: the number of rows scanned by a task that has a data source. ScanSize: the amount of scanned data. ScanTime: the total time consumed to scan data. PlanningTime: the time consumed to generate the execution plan. WallTime: the total CPU time of all operators in the query on each node. ProcessID: the process ID. `Type`: the sorting type. Valid values: Desc: descending. Asc: ascending.	[{"Field":"ExecuteTime","Type":"Desc"},{"Field":"HostAddress","Type":"Asc"}]
PageSize	integer	No	The number of entries to return on each page. Valid values: 10 (default) 30 50 100	10
PageNumber	integer	No	The page number. The value must be an integer that is greater than 0. The default value is 1.	1
ProxyUser	string	No	A reserved parameter.	无

Response elements

Element	Type	Description	Example
	object	The details of the list.
TotalCount	string	The total number of entries.	6974
PageSize	string	The number of entries per page.	10
RequestId	string	The request ID.	8A564B7F-8C00-43C0-8EC5-919FBB70573
PageNumber	string	The page number.	1
DBClusterId	string	The ID of the Data Lakehouse Edition cluster.	amv-t4nj8619bz2w3****
Items	array<object>	The list of entries.
	object	The list of SQL records.
HostAddress	string	The IP address and port number of the client that is used to execute the SQL statement.	100.104.XX.XX:43908
Succeed	string	Indicates whether the SQL statement was successfully executed. Valid values: true: The statement was successfully executed. false: The statement failed to be executed.	true
SQLText	string	The details of the SQL statement.	SELECT * FROM adb_hdfs_import_source
TotalTime	string	The execution duration of the SQL statement. Unit: milliseconds (ms).	216
ConnId	string	The connection ID.	14356****
DBName	string	The name of the database on which the SQL statement was executed.	adb_demo
SQLType	string	The type of the SQL statement.	SELECT
ExecuteTime	string	The time when the SQL statement started to be executed. The time is in the `yyyy-MM-dd HH:mm:ss` format and is your local time.	2022-08-12 10:10:00
ExecuteTimestamp	integer
ProcessID	string	The task ID.	202106081752021720161662490345362390
User	string	The username that is used to execute the SQL statement.	test
HasDiagnosticInfo	boolean

Examples

Success response

JSON format

{
  "TotalCount": "6974",
  "PageSize": "10",
  "RequestId": "8A564B7F-8C00-43C0-8EC5-919FBB70573",
  "PageNumber": "1",
  "DBClusterId": "amv-t4nj8619bz2w3****",
  "Items": [
    {
      "HostAddress": "100.104.XX.XX:43908",
      "Succeed": "true",
      "SQLText": "SELECT * FROM adb_hdfs_import_source",
      "TotalTime": "216",
      "ConnId": "14356****",
      "DBName": "adb_demo",
      "SQLType": "SELECT",
      "ExecuteTime": "2022-08-12 10:10:00",
      "ExecuteTimestamp": 0,
      "ProcessID": "202106081752021720161662490345362390",
      "User": "test",
      "HasDiagnosticInfo": false
    }
  ]
}

Error codes

HTTP status code	Error code	Error message	Description
404	InvalidDBCluster.NotFound	The DBClusterId provided does not exist in our records.	The specified DBClusterId parameter does not exist. Make sure that the DBClusterId value is valid.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.