Assets, billing, and limits of RDS SQL audit logs - Simple Log Service

Supported log types

RDS SQL audit logs record all operations performed on a database. The logs are obtained through network protocol analysis, which consumes minimal CPU resources and does not affect SQL execution efficiency. Logged operations include, but are not limited to:

Database logon and logoff operations.
Data Definition Language (DDL) operations: SQL statements that define a database structure, including CREATE, ALTER, DROP, TRUNCATE, and COMMENT.
Data Manipulation Language (DML) operations: SQL statements that perform operations, including SELECT, INSERT, UPDATE, and DELETE.
Other SQL execution operations, such as ROLLBACK and other control statements.
Information such as the execution latency, execution results, and number of affected rows of SQL statements.

Assets

Custom Simple Log Service Projects and Logstores
Important
- Do not delete the Simple Log Service Project and Logstore that correspond to the RDS SQL audit logs. Otherwise, logs cannot be pushed to Simple Log Service.
- When you create a custom Logstore, different billable items are generated based on the billing method. For more information, see Billable items.

Dedicated dashboards

By default, three dashboards are generated.

Note

Dedicated dashboards may be upgraded and updated at any time. Do not modify them. Instead, create custom dashboards to display query results. For more information, see Create a dashboard.

Dashboard	Description
RDS Audit Operations Hub	Shows overall access status and active database information, including the number of databases and tables accessed, execution errors, and total inserted, updated, deleted, and queried rows.
RDS Audit Performance Center	Shows O&M reliability metrics, including peak SQL execution counts, peak bandwidth for queries, updates, and deletions, and average execution time for all, query, update, and delete SQL statements.
RDS Audit Security Center	Shows database security metrics, including error counts, logon failures, bulk deletion and modification events, and risky SQL executions. It also shows the distribution of error types, external clients with errors, and the clients with the most errors.

Billing

After you enable the SQL Explorer (for MySQL) feature, DAS charges you on a pay-as-you-go basis. Hourly fee = Total amount of audit logs per hour × Unit price.

Note
The SQL Explorer feature is free for three-node Enterprise Edition (originally Finance Edition) instances.
If the Logstore uses the pay-by-feature billing method, Simple Log Service charges you for storage space, read traffic, requests, data transformation, and data shipping after RDS delivers the logs. For more information, see Billable items of the pay-by-feature billing method.
If the Logstore uses the pay-by-ingested-data billing method, Simple Log Service charges you for raw data ingested after RDS delivers the logs. For more information, see Billable items of the pay-by-ingested-data billing method.

Limits

Not all RDS types support the SQL Audit feature. For more information, see Overview of MySQL database features.
Only RDS instances with SQL Explorer and SQL Audit enabled can deliver SQL audit logs to Simple Log Service. If these features are not already enabled, enabling RDS audit log collection automatically enables them for eligible instances (non-Basic Edition). For more information about billing, see Billable items. If you stop collecting RDS audit logs and want to disable SQL Explorer, you must manually disable it in the RDS console. For more information, see SQL Explorer.
The RDS instance and the Simple Log Service Project must be in the same region.
This feature is supported in all regions except Local Cloud.

CloudLens for RDS

Simple Log Service provides CloudLens for RDS to collect RDS SQL logs with automatic collection and a streamlined setup. We recommend that you use CloudLens for RDS. For more information, see CloudLens for RDS.

The collection configurations of CloudLens for RDS and Import Data - RDS Audit are interchangeable. The main differences are as follows:

Property	Import Data - RDS Audit	CloudLens for RDS
Specify RDS instances for collection	Support	Support
Flexibly specify a destination logstore	Support	Supported
Automatic collection	Not supported	Support
Manual collection	Support	Support
View collection status	Not supported	Support