All Products
Search

This Product

    Simple Log Service:Collect RDS SQL audit logs

    Document Center

    Simple Log Service:Collect RDS SQL audit logs

    Last Updated:Aug 24, 2026

    Collect RDS SQL audit logs to Simple Log Service for centralized querying, analysis, and alerting.

    Prerequisites

    Note

    If your RDS instance is not available for selection in the Simple Log Service console, or if data shipping cannot be enabled for it, check the SQL Explorer settings of the instance in the RDS console and confirm that the paid edition is enabled and running. An instance that runs only the basic SQL audit edition does not meet the prerequisites of this topic.

    Procedure

    Important

    We recommend that you use CloudLens for RDS (formerly RDS Audit Center) to collect and manage RDS SQL audit logs. For cross-account or cross-region scenarios, we recommend that you use Log Audit Service. The data import method described in this topic is an alternative that CloudLens for RDS can replace.

    To use the data import method, perform the following steps.

    1. Log on to the Simple Log Service console.

    2. In the Import Data section, click RDS Audit - cloud service.

    3. On the Select Logstore tab, select the destination project and LogStore, and then click Next.

    4. On the Data Source Configuration tab, complete the RAM. Enable Shipping > Next.

      Important

      • If Simple Log Service is not authorized to ship logs, click Authorize next to RAM and follow the prompts. This creates a RAM role named AliyunLogArchiveRole that Simple Log Service uses to collect logs.

      • If your RDS instance is not listed or data shipping cannot be enabled, verify that the instance meets the prerequisites above.

      • The destination project and LogStore must be resources that you created for storing audit logs. Do not select a project or LogStore that is generated automatically for another feature, such as an alert-dedicated project or a LogStore whose name starts with sls-alert-. Audit logs that are shipped to such a resource are hard to locate afterwards. If you selected an incorrect destination, turn off Enable Shipping for the instance, turn it on again, and select the correct project and LogStore on the Select Logstore tab.

      The page indicates that logs from an RDS instance can be shipped only to a LogStore in the same region. The instance list includes columns such as Instance name, DB engine, Region, Enable data shipping (switch), and Destination. Find your target instance in the list and turn on the switch to enable data shipping.

    5. On the Query and Analysis Configurations tab, click Next.

      Simple Log Service automatically enables and configures an index for the LogStore that stores RDS SQL audit logs. If you need to modify the index settings, see Create an index.

    What to do next

    • Monitor and manage SQL statements on your RDS for MySQL instance with SQL Explorer and SQL audit.

    • Simple Log Service and RDS jointly provide CloudLens for RDS (formerly RDS Audit Center). Use it to view the collection status of RDS SQL audit logs, error logs, and slow query logs in real time, centrally manage collection configurations, and perform auditing, analysis, and alerting on the logs.

    • After Simple Log Service collects RDS SQL audit logs, you can query, analyze, download, ship, and transform the logs, or create alerts. Common operations for cloud service logs.

    FAQ

    Why are RDS SQL audit logs collected twice in Simple Log Service?

    Duplicate entries usually mean that two collection configurations are active for the same RDS instance at the same time. One configuration comes from the SQL audit log feature in the RDS console, which ships logs to a project that is created automatically for the cloud service. The other is the configuration that you create in Simple Log Service when you import RDS audit data as described in this topic.

    To find the duplicate, compare the SQL audit log shipping settings of the instance in the RDS console with the RDS audit import configuration in Simple Log Service, and check whether the two point to different projects or LogStores. You can also use CloudLens for RDS (formerly RDS Audit Center) to review the collection status and the collection configurations of the instance in one place.

    Keep only one configuration, and turn off Enable Shipping for the configuration that you no longer need. No further duplicate data is written after that. Log data that is already collected remains in the LogStore and is not removed automatically. To exclude it, wait until the retention period of the LogStore expires, or query the data with a time range that excludes the affected period.

    How do I use RDS SQL audit logs to send DingTalk alerts for slow queries or DELETE statements?

    1. Collect the SQL audit logs of the instance into Simple Log Service. If you also want to monitor slow queries, collect the slow query logs. You can follow the procedure in this topic, or manage both log types together with CloudLens for RDS (formerly RDS Audit Center).

    2. In the Simple Log Service console, open the LogStore that stores the logs and build a query that returns only the statements you want to be alerted on. Use the field names that are documented for RDS SQL audit logs to filter by statement type. To narrow the scope, add conditions such as the table name or the execution latency of the statement.

    3. Create an alert monitoring rule on the same LogStore, based on the query from the previous step. In the rule, set the query time range, the check interval, and the threshold that triggers the alert, such as the number of matching statements per check. Alerts on RDS SQL audit logs use the same alerting capabilities as other cloud service logs. For details, see Common operations for cloud service logs.

    4. Select Webhook - DingTalk ChatBot as the notification method of the rule, and enter the webhook address of the DingTalk chatbot that you added to the target DingTalk group. Matching statements are then pushed to that group in real time.