All Products
Search

This Product

    Data Security Center:Configure and enable audit mode

    Document Center

    Data Security Center:Configure and enable audit mode

    Last Updated:Sep 21, 2026

    Data Security Center (DSC) provides a data audit feature that analyzes audit logs to help you track malicious activity, identify unauthorized access, and investigate security incidents. To use the data audit feature, you must configure an audit mode. DSC then collects audit logs from the relevant databases according to the configured mode. This topic explains how to configure auditing.

    Prerequisites

    • You have activated the Free Edition of Data Security Center or purchased an Enterprise instance of Data Security Center.For more information, see Free Edition of Data Security Center or Purchase Data Security Center.

    • You have authorized data assets. For more information, see Asset authorization.

    • To enable the data audit feature for an ApsaraDB for OceanBase instance, you must first enable SQL Audit for a target tenant in the OceanBase instance. For more information, see SQL Audit.

      Important

      You can enable the audit mode for a target OceanBase instance as described in this document only after you enable SQL Audit for the target tenant in that instance. After you successfully enable the audit mode, the data audit service becomes available for all databases that belong to tenants with SQL Audit enabled in the OceanBase instance.

    Background

    The audit mode for a newly authorized instance is disabled by default. You must enable and configure an audit mode for your database assets. DSC then collects operation logs for the corresponding data assets and stores them as audit logs. Based on these audit logs and audit alert rules, DSC detects risks such as data breaches, vulnerability attacks, and SQL injection, and reports alerts.

    Audit modes

    Native log collection mode

    • Supported data asset types: OSS and Alibaba Cloud native databases. This mode does not support self-managed databases or Redis.

    • How it works: Data Security Center (DSC) automatically establishes a data collection link with the corresponding product to collect logs. The logs record all Data Query Language (DQL), Data Manipulation Language (DML), and Data Definition Language (DDL) operations. The database kernel outputs this information with minimal impact on CPU consumption. For more information, see the FAQ section in this topic.

      Warning

      In this audit mode, cloud products prioritize business operations over auditing. This may cause a small number of logs to be lost during periods of high business workload.

    • Billing: Additional collection fees apply. For billing details, see Additional fees for cloud products connected to DSC.

    Enable native log collection

    Step 1: Grant SLS access to data assets

    Native log collection requires SLS permissions to access your cloud resources.

    1. Log on to the Data Security Center console.

    2. In the left-side navigation pane, choose Data Audit > Native Data Auditing.

    3. On the Asset Management > Asset Configurations tab, click Authorize Now.

    4. On the RAM Quick Authorization page, click Confirm Authorization.

    Step 2: Enable an audit mode

    1. On the Asset Configurations tab, select a cloud product type, such as RDS.

    2. In the asset list, find the target asset and, in its Audit Mode column, select Cloud-native Audit Log Collection.

    Configure audit alerts

    • By default, DSC provides built-in audit rules for data assets, including database audit rules, OSS audit rules, and MaxCompute audit rules. DSC also supports custom audit rules. After you enable audit alert rules, you can use audit logs to detect risks such as abnormal operations, data breaches, vulnerability attacks, and SQL injections. For more information, see Configure and enable audit alert rules.

    • After you enable audit alert rules, DSC reports matching behaviors as DSC audit alerts. You can use the alert information and audit logs to analyze and handle related risks. For more information, see View and handle audit alerts.

    FAQ

    Q: Does enabling native log collection affect database performance? If so, what is the impact?

    A: Yes, but the impact is negligible.

    The impact on resources is as follows:

    • CPU and memory: Consumption is negligible.

    • Storage space: This is mainly used to store audit information. However, the data audit feature provided by DSC uses the storage space provided by DSC and does not occupy the storage space of the database instance.

    • Network: It does not affect network performance.

    • Disk performance: It does not affect disk performance because audit data is stored in DSC, not on the database instance's disk.

    Q: How do I configure a whitelist for audit alerts?

    A: You can add IP addresses and accounts that access your data assets to a whitelist. DSC will not generate audit alerts for access from these whitelisted entries. This helps you reduce false positives. For more information, see Manage whitelists.

    Related documents

    • After you configure the audit mode for a data asset, you can view its audit logs on the Log Analysis page. For more information, see View audit logs.

    • Data Security Center saves audit logs for online queries to its storage space. You can view your current storage usage and manage storage rules for online and archived logs. For more information, see Manage log storage.