All Products
Search

This Product

    Lindorm:Audit logs

    Document Center

    Lindorm:Audit logs

    Last Updated:Jul 21, 2026

    Lindorm provides an SLS-based audit log feature to record, search, and analyze SQL operations for improved data security.

    Prerequisites

    The time series engine is version 3.4.25 or later. To view or upgrade the current version, see Time series engine version notes and Upgrade the minor version.

    Notes

    • The audit log feature is available only for Lindorm V1 instances and is not supported in the latest version of Lindorm.

    • If you use a RAM user to enable the audit log feature, you must grant the AliyunLogFullAccess permission to the RAM user. For more information, see Manage permissions for a RAM user.

    • After you enable audit logging, Lindorm automatically creates a project and a dedicated Logstore in the same region as your instance.

      • The project name uses the format aliyun-product-{Alibaba Cloud account ID}-{region ID}.

      • The dedicated Logstore is named lindorm-tsdb-audit-log.

    • You cannot write other data to the dedicated Logstore or modify its indexes. However, features such as data query, statistical analysis, and alerting are not restricted.

    Enable audit logs

    Billing

    Simple Log Service (SLS) charges for the audit log feature on a pay-as-you-go basis. Fees are based on the storage space and retention period of your audit logs. For more information, see Simple Log Service pricing.

    Procedure

    1. Log on to the Lindorm console. In the upper-left corner of the page, select the region of the instance. On the Instances page, click the ID of the target instance or click View Instance Details in the Actions column for the instance.

    2. In the left-side navigation pane, click Time Series Engine. Then, click the Audit Logs tab.

    3. Click Enable Audit Logs. In the Audit Logs dialog box, click OK.

    Query audit logs

    Audit log types

    Lindorm captures three categories of SQL operations:

    Category Full name Recorded statements Excluded statements
    DDL Data Definition Language CREATE DATABASE, CREATE TABLE, ALTER TABLE, DROP TABLE —
    DML Data Manipulation Language SELECT, DELETE INSERT
    DCL Data Control Language GRANT, REVOKE —
    Note

    INSERT operations are excluded from DML audit logs. Design your audit strategy with this boundary in mind.

    Audit log retention period

    The default log retention period is 180 days. Logs are automatically deleted when the retention period ends.

    To change the retention period, see How to change the data retention period.

    View audit logs

    1. Log on to the Lindorm console. In the upper-left corner, select the region of the instance. On the Instances page, click the instance ID or click View Instance Details in the Actions column.

    2. In the left navigation pane, click Time Series Engine, then click Audit Logs. For query syntax and analysis options, see View and analyze logs.

    Audit log fields

    Each audit log entry contains the following fields:

    Field Description
    content The content of the request, such as a specific SQL statement
    database The name of the database
    instance_id The ID of the Lindorm instance
    ip The IP address of the client
    method The request method
    requestId The request ID
    requestTimeMs The response time, in milliseconds (ms)
    status The status code
    uri The URL of the request
    userAgent The user agent of the client
    userName The username that initiated the request