E-MapReduce:Audit logs

How it works

StarRocks writes all audit log entries to a local file at fe/log/fe.audit.log. You cannot access these logs through the internal system database. The AuditLoader plugin reads this file and imports the entries into the starrocks_audit_tbl table in the _starrocks_audit_db_ database using the HTTP PUT method.

The audit log feature is enabled by default and cannot be disabled.

Constraints

• Audit logs use dynamic partitioning. By default, the last 30 days of data are retained. To change the retention period, modify the dynamic_partition.start and dynamic_partition.end parameter values in the table properties.

View audit logs in StarRocks Manager

To locate the audit log database and table in the StarRocks Manager UI:

1. Go to the Metadata Management page.

2. In the Data Directory pane, expand default_catalog.

3. Find the _starrocks_audit_db_ database and the starrocks_audit_tbl table.

Query audit logs

To query audit logs, run SQL statements against the starrocks_audit_tbl table.

Example: Find slow queries from a specific user

SELECT queryId, timestamp, queryTime, stmt
FROM _starrocks_audit_db_.starrocks_audit_tbl
WHERE queryType = 'slow_query'
  AND user = 'root'
ORDER BY queryTime DESC
LIMIT 20;

Example: Check recent errors

SELECT queryId, timestamp, user, errorCode, errorMsg, stmt
FROM _starrocks_audit_db_.starrocks_audit_tbl
WHERE state = 'ERR'
ORDER BY timestamp DESC
LIMIT 20;

Audit log table schema

To view the full table creation statement, run:

SHOW CREATE TABLE starrocks_audit_tbl;

The starrocks_audit_tbl table uses the OLAP engine with queryId, timestamp, and queryTime as duplicate keys, partitioned by timestamp (range partitioning), and distributed by queryId across 3 buckets. The default storage uses LZ4 compression with a single replica.