|
| 1 | +====================== |
| 2 | +Auditing & Compliance |
| 3 | +====================== |
| 4 | + |
| 5 | +The ``EXA_DBA_AUDIT_*`` tables provide a full audit trail of SQL execution and user sessions. |
| 6 | +They are designed for security investigations, compliance reporting, and operational support. |
| 7 | + |
| 8 | +.. note:: |
| 9 | + All tables in this section require the ``SELECT ANY DICTIONARY`` system privilege. |
| 10 | + See :ref:`exa-statistics-access-control` for details on granting this privilege. |
| 11 | + |
| 12 | +EXA_DBA_AUDIT_SQL |
| 13 | +================== |
| 14 | + |
| 15 | +Records every SQL statement executed in the database. Key columns: |
| 16 | + |
| 17 | +.. list-table:: |
| 18 | + :header-rows: 1 |
| 19 | + :widths: 30 70 |
| 20 | + |
| 21 | + * - Column |
| 22 | + - Description |
| 23 | + * - ``USER_NAME`` |
| 24 | + - Database user who executed the statement |
| 25 | + * - ``SESSION_ID`` |
| 26 | + - Session identifier |
| 27 | + * - ``STMT_ID`` |
| 28 | + - Statement identifier within the session |
| 29 | + * - ``COMMAND_NAME`` |
| 30 | + - SQL command type (e.g., ``SELECT``, ``CREATE TABLE``) |
| 31 | + * - ``COMMAND_CLASS`` |
| 32 | + - Broad category: ``DQL``, ``DML``, ``DDL``, ``DCL``, ``TCL`` |
| 33 | + * - ``SQL_TEXT`` |
| 34 | + - Full SQL text (up to 2,000,000 characters) |
| 35 | + * - ``SUCCESS`` |
| 36 | + - ``TRUE`` if the statement completed without error |
| 37 | + * - ``ERROR_CODE`` / ``ERROR_TEXT`` |
| 38 | + - Error details for failed statements |
| 39 | + * - ``DURATION`` |
| 40 | + - Execution time in seconds |
| 41 | + * - ``STMT_START_TIME`` |
| 42 | + - Timestamp when the statement began executing |
| 43 | + |
| 44 | +EXA_DBA_AUDIT_SESSIONS |
| 45 | +======================== |
| 46 | + |
| 47 | +Records every database session, including login and logout events. Key columns: |
| 48 | + |
| 49 | +.. list-table:: |
| 50 | + :header-rows: 1 |
| 51 | + :widths: 30 70 |
| 52 | + |
| 53 | + * - Column |
| 54 | + - Description |
| 55 | + * - ``SESSION_ID`` |
| 56 | + - Unique session identifier |
| 57 | + * - ``USER_NAME`` |
| 58 | + - Database user who opened the session |
| 59 | + * - ``OS_USER`` |
| 60 | + - Operating system user on the client machine |
| 61 | + * - ``HOST`` |
| 62 | + - Client host address |
| 63 | + * - ``LOGIN_TIME`` |
| 64 | + - Session start timestamp |
| 65 | + * - ``LOGOUT_TIME`` |
| 66 | + - Session end timestamp (``NULL`` if session is still active) |
| 67 | + * - ``SUCCESS`` |
| 68 | + - ``TRUE`` for successful logins; ``FALSE`` for failed login attempts |
| 69 | + * - ``ENCRYPTED`` |
| 70 | + - ``TRUE`` if the connection was encrypted |
| 71 | + |
| 72 | +Managing Audit Log Size |
| 73 | +======================== |
| 74 | + |
| 75 | +Audit tables grow continuously. Remove old records while retaining recent history with |
| 76 | +``TRUNCATE AUDIT LOGS``: |
| 77 | + |
| 78 | +.. code-block:: sql |
| 79 | +
|
| 80 | + -- Keep the last 30 days; remove everything older |
| 81 | + TRUNCATE AUDIT LOGS KEEP FROM DAYS=30; |
| 82 | +
|
| 83 | +.. warning:: |
| 84 | + ``TRUNCATE AUDIT LOGS`` permanently deletes the removed records. This action cannot be undone. |
| 85 | + |
| 86 | +Recipes |
| 87 | +======= |
| 88 | + |
| 89 | +Find All Failed Statements with Error Details |
| 90 | +---------------------------------------------- |
| 91 | + |
| 92 | +.. code-block:: sql |
| 93 | +
|
| 94 | + SELECT USER_NAME, COMMAND_NAME, SQL_TEXT, |
| 95 | + ERROR_CODE, ERROR_TEXT, STMT_START_TIME |
| 96 | + FROM EXA_DBA_AUDIT_SQL |
| 97 | + WHERE SUCCESS = FALSE |
| 98 | + ORDER BY STMT_START_TIME DESC |
| 99 | + LIMIT 50; |
| 100 | +
|
| 101 | +Track Login History for a Specific User |
| 102 | +----------------------------------------- |
| 103 | + |
| 104 | +.. code-block:: sql |
| 105 | +
|
| 106 | + SELECT SESSION_ID, LOGIN_TIME, LOGOUT_TIME, |
| 107 | + HOST, OS_USER, ENCRYPTED |
| 108 | + FROM EXA_DBA_AUDIT_SESSIONS |
| 109 | + WHERE USER_NAME = 'MY_USER' |
| 110 | + ORDER BY LOGIN_TIME DESC; |
| 111 | +
|
| 112 | +List All DDL Statements Executed Today |
| 113 | +---------------------------------------- |
| 114 | + |
| 115 | +.. code-block:: sql |
| 116 | +
|
| 117 | + SELECT USER_NAME, COMMAND_NAME, SQL_TEXT, STMT_START_TIME |
| 118 | + FROM EXA_DBA_AUDIT_SQL |
| 119 | + WHERE COMMAND_CLASS = 'DDL' |
| 120 | + AND CAST(STMT_START_TIME AS DATE) = CURRENT_DATE |
| 121 | + ORDER BY STMT_START_TIME DESC; |
| 122 | +
|
| 123 | +Remove Audit Logs Older Than 30 Days |
| 124 | +-------------------------------------- |
| 125 | + |
| 126 | +.. code-block:: sql |
| 127 | +
|
| 128 | + TRUNCATE AUDIT LOGS KEEP FROM DAYS=30; |
| 129 | +
|
| 130 | +**Further reading:** `EXA_DBA_AUDIT_SQL <https://docs.exasol.com/db/latest/sql_references/system_tables/statistical/exa_dba_audit_sql.htm>`_ · `EXA_DBA_AUDIT_SESSIONS <https://docs.exasol.com/db/latest/sql_references/system_tables/statistical/exa_dba_audit_sessions.htm>`_ · `Auditing Concepts <https://docs.exasol.com/db/latest/database_concepts/auditing.htm>`_ |
0 commit comments