StarRocks almacena todos los registros de auditoría en el archivo local fe/log/fe.audit.log. Estos registros no se pueden consultar mediante la base de datos interna del sistema. La función de registro de auditoría está habilitada de forma predeterminada y el plugin AuditLoader se instala automáticamente. Este plugin lee los registros del archivo local y los importa a una base de datos de StarRocks mediante el método HTTP PUT. Después, puede consultar y analizar todas las operaciones ejecutadas en su base de datos.
Notas
La función de registro de auditoría está habilitada de forma predeterminada y crea automáticamente la base de datos _starrocks_audit_db_ y la tabla starrocks_audit_tbl. Todos los registros de auditoría posteriores se almacenan en esta tabla. No elimine la base de datos _starrocks_audit_db_ ni la tabla starrocks_audit_tbl, ya que esto provocará un error en la función de consulta de tareas SQL de Manager.
Los registros de auditoría usan particionamiento dinámico y conservan los datos durante 30 días de forma predeterminada. Para ajustar el periodo de retención de datos, modifique los parámetros
dynamic_partition.startydynamic_partition.end.No es posible deshabilitar la función de registro de auditoría.
Funciones
En la página de EMR StarRocks Manager, haga clic en Metadata Management en el panel de navegación izquierdo. Dentro de default_catalog encontrará la base de datos _starrocks_audit_db_, creada automáticamente, junto con su tabla starrocks_audit_tbl.
Para consultar la instrucción CREATE TABLE de starrocks_audit_tbl, ejecute SHOW CREATE TABLE starrocks_audit_tbl;:
CREATE TABLE `starrocks_audit_tbl` (
`queryId` varchar(64) NOT NULL COMMENT "Unique ID for the query",
`timestamp` datetime NOT NULL COMMENT "Start time of the query",
`queryTime` bigint(20) NOT NULL COMMENT "Query execution time (milliseconds)",
`queryType` varchar(12) NULL COMMENT "Query type (query, slow_query, connection)",
`clientIp` varchar(32) NULL COMMENT "IP address of the client",
`user` varchar(64) NULL COMMENT "Username for the query",
`authorizedUser` varchar(64) NULL COMMENT "Unique user identifier, that is, user_identity",
`resourceGroup` varchar(64) NULL COMMENT "Name of the resource group",
`catalog` varchar(32) NULL COMMENT "Name of the data catalog",
`db` varchar(96) NULL COMMENT "Database where the query was run",
`state` varchar(8) NULL COMMENT "Query status (EOF, ERR, OK)",
`errorCode` varchar(512) NULL COMMENT "Error code",
`scanBytes` bigint(20) NULL COMMENT "Bytes scanned by the query",
`scanRows` bigint(20) NULL COMMENT "Rows scanned by the query",
`returnRows` bigint(20) NULL COMMENT "Rows returned by the query",
`cpuCostNs` bigint(20) NULL COMMENT "CPU time consumed by the query (nanoseconds)",
`memCostBytes` bigint(20) NULL COMMENT "Memory consumed by the query (bytes)",
`stmtId` int(11) NULL COMMENT "Incremental ID for the SQL statement",
`isQuery` tinyint(4) NULL COMMENT "Whether the SQL statement is a query (1 or 0)",
`feIp` varchar(128) NULL COMMENT "IP address of the frontend (FE) that executed the statement",
`stmt` varchar(1048576) NULL COMMENT "Original SQL statement",
`digest` varchar(32) NULL COMMENT "Fingerprint of the slow SQL statement",
`planCpuCosts` double NULL COMMENT "CPU time consumed during the query planning phase (nanoseconds)",
`planMemCosts` double NULL COMMENT "Memory consumed during the query planning phase (bytes)",
`warehouse` varchar(96) NULL COMMENT "Compute group that the query uses",
`stmtType` varchar(8) NULL COMMENT "SQL type (DQL, DML, DDL, DCL, OTHER)",
`isFilter` tinyint(4) NULL COMMENT "Whether the SQL statement was filtered (1 or 0)",
`errorMsg` varchar(1048576) NULL COMMENT "Error details",
`pendingTimeMs` bigint(20) NULL COMMENT "Time the query spent waiting in the queue (milliseconds)",
`candidateMVs` varchar(65533) NULL COMMENT "A list of candidate materialized views considered for the query.",
`hitMvs` varchar(65533) NULL COMMENT "A list of materialized views that the query successfully used (hit)."
) ENGINE=OLAP
DUPLICATE KEY(`queryId`, `timestamp`, `queryTime`)
COMMENT "Audit log table"
PARTITION BY RANGE(`timestamp`)
(PARTITION p20250909 VALUES [("0000-01-01 00:00:00"), ("2025-09-10 00:00:00")),
PARTITION p20250910 VALUES [("2025-09-10 00:00:00"), ("2025-09-11 00:00:00")),
PARTITION p20250911 VALUES [("2025-09-11 00:00:00"), ("2025-09-12 00:00:00")),
PARTITION p20250912 VALUES [("2025-09-12 00:00:00"), ("2025-09-13 00:00:00")),
PARTITION p20250913 VALUES [("2025-09-13 00:00:00"), ("2025-09-14 00:00:00")))
DISTRIBUTED BY HASH(`queryId`) BUCKETS 3
PROPERTIES (
"compression" = "LZ4",
"datacache.enable" = "true",
"dynamic_partition.buckets" = "3",
"dynamic_partition.enable" = "true",
"dynamic_partition.end" = "3",
"dynamic_partition.history_partition_num" = "0",
"dynamic_partition.prefix" = "p",
"dynamic_partition.start" = "-30",
"dynamic_partition.time_unit" = "DAY",
"dynamic_partition.time_zone" = "Asia/Shanghai",
"enable_async_write_back" = "false",
"replication_num" = "1",
"storage_volume" = "builtin_storage_volume"
);