CloudLens for RDS centralizes RDS SQL audit logs, error logs, and slow query logs into SLS. You can monitor collection status in real time, manage configurations, and audit, analyze, or alert on collected logs.
Features
CloudLens for RDS provides:
-
Collection management
ImportantError logs and slow query logs are supported only for RDS for MySQL and RDS for PostgreSQL.
-
Manage collection status of SQL audit logs, slow query logs, and error logs.
-
Auto-collect logs from existing and new RDS instances.
-
Manage destination projects and Logstores.
-
-
Log auditing
-
Store, query, and analyze RDS SQL audit logs in real time.
-
Visualization reports with email and DingTalk subscription.
-
Built-in alert rules for flexible alerting policies.
-
Supported log types
CloudLens for RDS collects SQL audit logs, slow query logs, and error logs. SQL audit logs capture all database operations by analyzing network protocols with minimal CPU overhead and no impact on SQL execution. SQL audit logs cover:
-
Logon and logoff operations.
-
Data Definition Language (DDL) operations: SQL statements that define the database structure, such as CREATE, ALTER, DROP, TRUNCATE, and COMMENT.
-
Data Manipulation Language (DML) operations: SQL operation statements, such as SELECT, INSERT, UPDATE, and DELETE.
-
Other SQL operations, such as rollbacks and control statements.
-
Execution metadata: latency, results, and affected row counts.
Asset details
-
Custom SLS projects and Logstores
ImportantDo not delete the SLS projects and Logstores used for RDS logs. Deleting them stops log delivery to SLS.
-
Dedicated dashboards
Three dashboards are generated by default.
NoteDedicated dashboards may be updated at any time. Do not modify them. To display custom query results, create your own dashboards. Create a dashboard.
Dashboard
Description
RDS Audit Operations Hub
Overall access status and active database metrics: operated databases and tables, execution errors, and cumulative inserted, updated, deleted, and queried rows.
RDS Audit Performance Center
O&M and reliability metrics: peak SQL executions, peak query/update/delete bandwidth, and average SQL execution times by operation type.
RDS Audit Security Center
Security metrics: errors, logon failures, large-scale deletion and modification events, dangerous SQL executions, and error distribution by operation type and client.
Billing
-
SQL audit log collection requires the SQL Explorer (for MySQL) feature of an RDS instance. The SQL Explorer feature is a paid RDS feature. Billing Items.
NoteThe SQL Explorer feature is free for three-node Enterprise Edition (formerly Finance Edition) instances.
-
After RDS logs are collected in SLS, you are charged for storage, read traffic, requests, data transformation, and data shipping. Pay-as-you-go.
Limits
-
Not all RDS instance types support SQL Audit. MySQL Database Feature Overview.
-
Log collection depends on the SQL Explorer (for MySQL) feature of an RDS instance.
Enabling RDS SQL audit log collection automatically enables the SQL Explorer (for MySQL) feature on the RDS instance. To disable SQL Explorer after stopping audit log collection, manually disable it in the RDS console. Disable SQL Explorer.
-
The RDS instance and the Simple Log Service project must be in the same region.
-
All regions except for local clouds are supported.
RDS audit log collection methods
SLS supports three methods to collect RDS SQL audit logs.
CloudLens for RDS and Data Import - RDS Audit share collection configurations. Log Audit Service uses an independent channel unaffected by the other two methods.
-
CloudLens for RDS
-
Entry: In the SLS console, go to Log Applications > Audit & Security > CloudLens for RDS.
-
Recommended for single-account log collection.
-
-
-
Entry: In the SLS console, go to Log Applications > Audit & Security > Log Audit Service.
-
Recommended for cross-account and cross-region collection.
-
-
-
Entry: In the SLS console, go to Data Import > Cloud Service > RDS Audit - Cloud Service.
-
Not recommended. Use CloudLens for RDS instead.
-
|
Property |
CloudLens for RDS |
Log Audit Service |
Data Import - RDS Audit |
|
Specify RDS instance granularity |
Supported |
Supported |
Supported |
|
Flexibly specify destination logstores |
Supported |
Not supported |
Supported |
|
Cross-region collection |
Not supported |
Supported |
Not supported |
|
Cross-account collection |
Not supported |
Supported |
Not supported |
|
Automatic collection |
Supported |
Supported |
Not supported |
|
Manual collection |
Supported |
Not supported |
Supported |
|
View collection status |
Supported |
Not supported |
Not supported |
Notes
The CloudLens feature requires at least one project to exist under your Alibaba Cloud account.
When you enable and use the CloudLens feature, Simple Log Service checks whether a project exists under your account based on the following logic.
Detection logic
When you enable the CloudLens feature for the first time, Simple Log Service checks whether a project exists under your Alibaba Cloud account. If no project exists, a project named
aliyun-product-data-Alibaba Cloud account ID-cn-heyuanis created in the China (Heyuan) region.After you enable the CloudLens feature and navigate to the CloudLens page, Simple Log Service checks only whether a project exists under your Alibaba Cloud account. It does not automatically create a project in the China (Heyuan) region. You can manually create a project. For more information about how to create a project, see Manage projects.
Delete a project
To delete the
aliyun-product-data-Alibaba Cloud account ID-cn-heyuanproject, open Cloud Shell and run the following command. Replace Alibaba Cloud account ID with your actual account ID.aliyunlog log delete_project --project_name=aliyun-product-data-Alibaba Cloud account ID-cn-heyuan --region-endpoint=cn-heyuan.log.aliyuncs.comFor more information about how to delete other projects and Logstores, see Manage Logstores and Manage projects.