ApsaraDB RDS:Use the SQL Explorer and Audit feature

logout! marks a disconnection event. The execution duration shown is the idle time between the last interaction and the disconnection. Status code 1158 means network disconnection, which can happen because:

• The client connection timed out

• The server disconnected

• The connection exceeded the interactive_timeout or wait_timeout value

A % in the Access Source column appears when a stored procedure is involved. This happens because the stored procedure is defined with a DEFINER that includes % as the host — for example, ` CREATE DEFINER=test_user@% PROCEDURE das() `.

To reproduce this behavior:

1. In the ApsaraDB RDS console, create a database and a standard account, and grant permissions on the database to that account. For details, see Create accounts and databases.

2. Connect to the instance using the test_user account via the CLI. For details, see Use a database client or the CLI to connect to an ApsaraDB RDS for MySQL instance.

3. Switch to the testdb database and create a stored procedure:

   -- Switch to testdb
   USE testdb;
   
   -- Create a stored procedure
   DELIMITER $$
   DROP PROCEDURE IF EXISTS `das` $$
   CREATE DEFINER=`test_user`@`%` PROCEDURE `das`()
   BEGIN
   SELECT * FROM information_schema.processlist WHERE Id = CONNECTION_ID();
   END $$
   DELIMITER;

4. Connect to the instance using a privileged account. For details, see Use a database client or the CLI to connect to an ApsaraDB RDS for MySQL instance.

5. Call the stored procedure:

   -- Switch to testdb
   USE testdb;
   
   -- Call the stored procedure
   CALL das();

   Expected output:

   +--------+-----------+--------+--------+---------+------+-----------+-------------------------------------------------------------------------+
   | ID     | USER      | HOST   | DB     | COMMAND | TIME | STATE     | INFO                                                                    |
   +--------+-----------+--------+--------+---------+------+-----------+-------------------------------------------------------------------------+
   | 487818 | test_user | %:2065 | testdb | Query   |    0 | executing | SELECT * FROM information_schema.processlist WHERE Id = CONNECTION_ID() |
   +--------+-----------+--------+--------+---------+------+-----------+-------------------------------------------------------------------------+

The fast query cache feature is enabled. When the same query hits the cache, MySQL returns the cached result directly without scanning InnoDB — so the scanned row count is zero. For details, see Fast query cache.

Both log types capture incremental changes to your RDS instance, but they differ in coverage and use cases:

Binary log files currently being written cannot be transferred to OSS. As a result, some files may fail to upload when using the Upload Binlogs feature. For details, see How do I remotely obtain and parse the binary log file of an ApsaraDB RDS for MySQL instance?

SQL Explorer and Audit is an updated version of SQL Explorer. The entry point is now labeled SQL Explorer and Audit.

No. Only the latest version of SQL Explorer and Audit can be enabled on RDS instances.

No. Exporting audit records does not delete them from the system.

If table data is accidentally or maliciously deleted, you can use SQL Explorer and Audit to identify the account and IP address that performed the deletion:

1. Log on to the ApsaraDB RDS console. Find the instance and click its ID.

2. In the left-side navigation pane, choose Autonomy Services > SQL Explorer and Audit.

3. On the Audit tab, in the Logs section, set the time range to cover the period when the deletion occurred, and optionally filter by database name.

4. Enter DELETE in the SQL keyword search box and click the search icon.

5. In the results, find the DELETE operation record and click it to view details, including the account name and client IP address.

Fields from error logs, such as the database name and client IP address, can be used as filter conditions in SQL Explorer and Audit to locate abnormal connections. Procedure:

1. Log on to the ApsaraDB RDS console and go to the instance details page. In the left-side navigation pane, choose Autonomy Services > SQL Explorer and Audit.

2. On the Audit tab, click Enable Advanced Query to expand the advanced filter conditions.

3. In the Database field, enter the database name, for example, battery.

4. In the Client IP field, enter the host from the error log, for example, 172.25.244.207.

5. Set the Time Range to cover the period when the abnormal connection occurred.

6. Click Query to run the combined filter query.

You can filter Search (audit) results by operation type. On the SQL Explorer and Audit page, open the Search tab and set the Operation type filter to LOGIN to query the logon history of the instance. The result list includes the User (logon account) and Client IP columns, which help you identify who logged on and from where.

SQL Explorer and Audit records operations at the SQL statement level and does not provide before-and-after value comparison at the field level. To view the value of a specific field, such as status, before and after a change, use the data tracking feature of Data Management (DMS) to locate the source of the change.