audit_log_path

Description

audit_log_path specifies the output directory for audit logs.

Privilege requirements

• Query the parameter

  The sys tenant and all user tenants can query this parameter by using the SHOW PARAMETERS statement or the GV$OB_PARAMETERS view.

• Modify the parameter

  The sys tenant and user tenants can modify this parameter by using the ALTER SYSTEM SET statement.

Attributes

Usage

• Local storage

  Audit logs from different OBServers in the same tenant are written to different directories. In a single cluster, you can set the same output path for different tenants. In this case, the directory structure includes an additional tenant_id layer. The local output directory structure is as follows:

  - ${audit_log_path}
  - tenant_id_1
  - ip1:port1
      - audit.log.20231031080646317[.zst]
      - audit.log.20231031084835263[.zst]
      - audit.log
  - ip2:port2
      - audit.log.20231031072457838[.zst]
      - audit.log.20231031093023607[.zst]
      - audit.log.20231031101213751[.zst]
      - audit.log
  - tenant_id_2
  

• Cloud storage

  OceanBase Database supports writing audit logs from multiple OBServers to the same oss/nfs directory. To ensure the performance of concurrent append writes and support compression and encryption, only archived files are stored in cloud storage. Append writes are performed on local files in the audit directory. When you consume audit logs from cloud storage, the most recent records may exist only on the local OBServer and may not be visible to downstream consumers.

Example

• Set the output directory for audit logs to file:///logs/audit.

  obclient> ALTER SYSTEM SET audit_log_path='file:///logs/audit';
  

• Set the output directory for audit logs to oss://ob-audit/audit/?host=$OSS_HOST&access_id=$OSS_ACCESS_ID&access_key=$OSS_ACCESS_KEY.

  obclient> ALTER SYSTEM SET audit_log_path = 'oss://ob-audit/audit/?host=$OSS_HOST&access_id=$OSS_ACCESS_ID&access_key=$OSS_ACCESS_KEY';
  

References

• Security audit overview