User and Permission Audit

audit_login_logout

Parameter description: Specifies whether to audit the MogDB user's login (including login success and failure) and logout.

This parameter is a SIGHUP parameter. Set it based on instructions provided in Table 1 GUC parameters.

Value range: an integer ranging from 0 to 7

• 0 indicates that the function of auditing users' logins and logouts is disabled.
• 1 indicates that only successful user logins are audited.
• 2 indicates that only failed user logins are audited.
• 3 indicates that successful and failed user logins are audited.
• 4 indicates that only user logouts are audited.
• 5 indicates that successful user logouts and logins are audited.
• 6 indicates that failed user logouts and logins are audited.
• 7 indicates that successful user logins, failed user logins, and logouts are audited.

Default value: 7

audit_database_process

Parameter description: Specifies whether to audit the MogDB user's login (including login success and failure) and logout.

This parameter is a SIGHUP parameter. Set it based on instructions provided in Table 1 GUC parameters.

Value range: 0 or 1

• 0 indicates that the function of auditing MogDB start, stop, recovery, and switchover operations of a database is disabled.
• 1 indicates that the function of auditing MogDB start, stop, recovery, and switchover operations of a database is enabled.

Default value: 1

Note:

When MogDB starts, DN performs the switchover process. Therefore, when DN starts, the type in the audit log is system_switch.

audit_user_locked

Parameter description: Specifies whether to audit the MogDB user's locking and unlocking.

This parameter is a SIGHUP parameter. Set it based on instructions provided in Table 1 GUC parameters.

Value range: 0 or 1

• 0 indicates that the function of auditing user's locking and unlocking is disabled.
• 1 indicates that the function of auditing user's locking and unlocking is enabled.

Default value: 1

audit_user_violation

Parameter description: Specifies whether to audit the access violation operations of a user.

This parameter is a SIGHUP parameter. Set it based on instructions provided in Table 1 GUC parameters.

Value range: 0 or 1

• 0 indicates that the function of auditing the access violation operations of a user is disabled.
• 1 indicates that the function of auditing the access violation operations of a user is enabled.

Default value: 0

audit_grant_revoke

Parameter description: Specifies whether to audit the granting and reclaiming of the MogDB user's permission.

This parameter is a SIGHUP parameter. Set it based on instructions provided in Table 1 GUC parameters.

Value range: 0 or 1

• 0 indicates that the function of auditing the granting and reclaiming of a user's permission is disabled.
• 1 indicates that the function of auditing the granting and reclaiming of a user's permission is enabled.

Default value: 1

full_audit_users

Parameter description: This parameter is used to configure the Full Audit User List to record audit logs for all auditable operations performed by users in the list.

This parameter is a SIGHUP parameter. Set it based on instructions provided in Table 1 GUC parameters.

Value range: String, multiple usernames should be separated by commas.

Default value: Empty string

no_audit_client

Parameter description: This parameter is used to configure the list of client names and IP addresses that are not to be audited. The format of the parameter is: client_name@IP, same as client_conninfo field in pg_query_audit function, e.g. cm_agent@127.0.0.1, gs_clean@127.0.0.1.

This parameter is a SIGHUP parameter. Set it based on instructions provided in Table 1 GUC parameters.

Value range: String, multiple configuration items need to be separated by commas.

Default value: Empty string

Note:

• When the executed SQL statement satisfies both full_audit_users and no_audit_client parameter configurations, the no_audit_client configuration takes precedence and the audit log is not recorded.
• Database server-side internal tools or communication between nodes will also generate audit logs for these lower-risk audit scenarios can be configured no_audit_client parameter does not record audits to save audit log space, enhance audit log query performance.