数据库活动流的审计日志内容和示例
受监控的事件在数据库活动流中表示为 JSON 字符串。结构包含一个 JSON 对象,该对象包含一个 DatabaseActivityMonitoringRecord
,后者反过来包含活动事件的 databaseActivityEventList
阵列。
活动流的审计日志示例
以下是活动事件记录的已解密 JSON 审核日志示例。
例 Aurora PostgreSQLCONNECT SQL 语句的活动事件记录
以下活动事件记录显示 psql 客户端(clientApplication
)使用 CONNECT
SQL 语句(command
)进行的登录。
{ "type":"DatabaseActivityMonitoringRecords", "version":"1.1", "databaseActivityEvents": { "type":"DatabaseActivityMonitoringRecord", "clusterId":"cluster-4HNY5V4RRNPKKYB7ICFKE5JBQQ", "instanceId":"db-FZJTMYKCXQBUUZ6VLU7NW3ITCM", "databaseActivityEventList":[ { "startTime": "2019-10-30 00:39:49.940668+00", "logTime": "2019-10-30 00:39:49.990579+00", "statementId": 1, "substatementId": 1, "objectType": null, "command": "CONNECT", "objectName": null, "databaseName": "postgres", "dbUserName": "rdsadmin", "remoteHost": "172.31.3.195", "remotePort": "49804", "sessionId": "5ce5f7f0.474b", "rowCount": null, "commandText": null, "paramList": [], "pid": 18251, "clientApplication": "psql", "exitCode": null, "class": "MISC", "serverVersion": "2.3.1", "serverType": "PostgreSQL", "serviceName": "Amazon Aurora PostgreSQL-Compatible edition", "serverHost": "172.31.3.192", "netProtocol": "TCP", "dbProtocol": "Postgres 3.0", "type": "record", "errorMessage": null } ] }, "key":"decryption-key" }
例 Aurora MySQL CONNECT SQL 语句的活动事件记录
以下活动事件记录显示 mysql 客户端(clientApplication
)使用 CONNECT
SQL 语句(command
)进行的登录。
{ "type":"DatabaseActivityMonitoringRecord", "clusterId":"cluster-
some_id
", "instanceId":"db-some_id
", "databaseActivityEventList":[ { "logTime":"2020-05-22 18:07:13.267214+00", "type":"record", "clientApplication":null, "pid":2830, "dbUserName":"rdsadmin", "databaseName":"", "remoteHost":"localhost", "remotePort":"11053", "command":"CONNECT", "commandText":"", "paramList":null, "objectType":"TABLE", "objectName":"", "statementId":0, "substatementId":1, "exitCode":"0", "sessionId":"725121", "rowCount":0, "serverHost":"master", "serverType":"MySQL", "serviceName":"Amazon Aurora MySQL", "serverVersion":"MySQL 5.7.12", "startTime":"2020-05-22 18:07:13.267207+00", "endTime":"2020-05-22 18:07:13.267213+00", "transactionId":"0", "dbProtocol":"MySQL", "netProtocol":"TCP", "errorMessage":"", "class":"MAIN" } ] }
例 Aurora PostgreSQL的活动事件记录
以下示例显示 Aurora PostgreSQL的 CREATE TABLE
事件。
{ "type":"DatabaseActivityMonitoringRecords", "version":"1.1", "databaseActivityEvents": { "type":"DatabaseActivityMonitoringRecord", "clusterId":"cluster-4HNY5V4RRNPKKYB7ICFKE5JBQQ", "instanceId":"db-FZJTMYKCXQBUUZ6VLU7NW3ITCM", "databaseActivityEventList":[ { "startTime": "2019-05-24 00:36:54.403455+00", "logTime": "2019-05-24 00:36:54.494235+00", "statementId": 2, "substatementId": 1, "objectType": null, "command": "CREATE TABLE", "objectName": null, "databaseName": "postgres", "dbUserName": "rdsadmin", "remoteHost": "172.31.3.195", "remotePort": "34534", "sessionId": "5ce73c6f.7e64", "rowCount": null, "commandText": "create table my_table (id serial primary key, name varchar(32));", "paramList": [], "pid": 32356, "clientApplication": "psql", "exitCode": null, "class": "DDL", "serverVersion": "2.3.1", "serverType": "PostgreSQL", "serviceName": "Amazon Aurora PostgreSQL-Compatible edition", "serverHost": "172.31.3.192", "netProtocol": "TCP", "dbProtocol": "Postgres 3.0", "type": "record", "errorMessage": null } ] }, "key":"decryption-key" }
例 Aurora MySQL CREATE TABLE 语句的活动事件记录
以下示例显示 Aurora MySQL 的 CREATE TABLE
语句。操作表示为两个单独的事件记录。一个事件具有 "class":"MAIN"
。另一个事件具有 "class":"AUX"
。消息可能按任何顺序到达。logTime
事件的 MAIN
字段始终早于任何对应 logTime
事件的 AUX
字段。
以下示例显示 class
值为 MAIN
的事件。
{ "type":"DatabaseActivityMonitoringRecord", "clusterId":"cluster-
some_id
", "instanceId":"db-some_id
", "databaseActivityEventList":[ { "logTime":"2020-05-22 18:07:12.250221+00", "type":"record", "clientApplication":null, "pid":2830, "dbUserName":"master", "databaseName":"test", "remoteHost":"localhost", "remotePort":"11054", "command":"QUERY", "commandText":"CREATE TABLE test1 (id INT)", "paramList":null, "objectType":"TABLE", "objectName":"test1", "statementId":65459278, "substatementId":1, "exitCode":"0", "sessionId":"725118", "rowCount":0, "serverHost":"master", "serverType":"MySQL", "serviceName":"Amazon Aurora MySQL", "serverVersion":"MySQL 5.7.12", "startTime":"2020-05-22 18:07:12.226384+00", "endTime":"2020-05-22 18:07:12.250222+00", "transactionId":"0", "dbProtocol":"MySQL", "netProtocol":"TCP", "errorMessage":"", "class":"MAIN" } ] }
以下示例显示 class
值为 AUX
的相应事件。
{ "type":"DatabaseActivityMonitoringRecord", "clusterId":"cluster-
some_id
", "instanceId":"db-some_id
", "databaseActivityEventList":[ { "logTime":"2020-05-22 18:07:12.247182+00", "type":"record", "clientApplication":null, "pid":2830, "dbUserName":"master", "databaseName":"test", "remoteHost":"localhost", "remotePort":"11054", "command":"CREATE", "commandText":"test1", "paramList":null, "objectType":"TABLE", "objectName":"test1", "statementId":65459278, "substatementId":2, "exitCode":"", "sessionId":"725118", "rowCount":0, "serverHost":"master", "serverType":"MySQL", "serviceName":"Amazon Aurora MySQL", "serverVersion":"MySQL 5.7.12", "startTime":"2020-05-22 18:07:12.226384+00", "endTime":"2020-05-22 18:07:12.247182+00", "transactionId":"0", "dbProtocol":"MySQL", "netProtocol":"TCP", "errorMessage":"", "class":"AUX" } ] }
例 Aurora PostgreSQL的活动事件记录
以下示例显示 SELECT
事件。
{ "type":"DatabaseActivityMonitoringRecords", "version":"1.1", "databaseActivityEvents": { "type":"DatabaseActivityMonitoringRecord", "clusterId":"cluster-4HNY5V4RRNPKKYB7ICFKE5JBQQ", "instanceId":"db-FZJTMYKCXQBUUZ6VLU7NW3ITCM", "databaseActivityEventList":[ { "startTime": "2019-05-24 00:39:49.920564+00", "logTime": "2019-05-24 00:39:49.940668+00", "statementId": 6, "substatementId": 1, "objectType": "TABLE", "command": "SELECT", "objectName": "public.my_table", "databaseName": "postgres", "dbUserName": "rdsadmin", "remoteHost": "172.31.3.195", "remotePort": "34534", "sessionId": "5ce73c6f.7e64", "rowCount": 10, "commandText": "select * from my_table;", "paramList": [], "pid": 32356, "clientApplication": "psql", "exitCode": null, "class": "READ", "serverVersion": "2.3.1", "serverType": "PostgreSQL", "serviceName": "Amazon Aurora PostgreSQL-Compatible edition", "serverHost": "172.31.3.192", "netProtocol": "TCP", "dbProtocol": "Postgres 3.0", "type": "record", "errorMessage": null } ] }, "key":"decryption-key" }
{ "type": "DatabaseActivityMonitoringRecord", "clusterId": "", "instanceId": "db-4JCWQLUZVFYP7DIWP6JVQ77O3Q", "databaseActivityEventList": [ { "class": "TABLE", "clientApplication": "Microsoft SQL Server Management Studio - Query", "command": "SELECT", "commandText": "select * from [testDB].[dbo].[TestTable]", "databaseName": "testDB", "dbProtocol": "SQLSERVER", "dbUserName": "test", "endTime": null, "errorMessage": null, "exitCode": 1, "logTime": "2022-10-06 21:24:59.9422268+00", "netProtocol": null, "objectName": "TestTable", "objectType": "TABLE", "paramList": null, "pid": null, "remoteHost": "local machine", "remotePort": null, "rowCount": 0, "serverHost": "172.31.30.159", "serverType": "SQLSERVER", "serverVersion": "15.00.4073.23.v1.R1", "serviceName": "sqlserver-ee", "sessionId": 62, "startTime": null, "statementId": "0x03baed90412f564fad640ebe51f89b99", "substatementId": 1, "transactionId": "4532935", "type": "record", "engineNativeAuditFields": { "target_database_principal_id": 0, "target_server_principal_id": 0, "target_database_principal_name": "", "server_principal_id": 2, "user_defined_information": "", "response_rows": 0, "database_principal_name": "dbo", "target_server_principal_name": "", "schema_name": "dbo", "is_column_permission": true, "object_id": 581577110, "server_instance_name": "EC2AMAZ-NFUJJNO", "target_server_principal_sid": null, "additional_information": "", "duration_milliseconds": 0, "permission_bitmask": "0x00000000000000000000000000000001", "data_sensitivity_information": "", "session_server_principal_name": "test", "connection_id": "AD3A5084-FB83-45C1-8334-E923459A8109", "audit_schema_version": 1, "database_principal_id": 1, "server_principal_sid": "0x010500000000000515000000bdc2795e2d0717901ba6998cf4010000", "user_defined_event_id": 0, "host_name": "EC2AMAZ-NFUJJNO" } } ] }
例 Aurora MySQL SELECT 语句的活动事件记录
以下示例显示 SELECT
事件。
以下示例显示 class
值为 MAIN
的事件。
{ "type":"DatabaseActivityMonitoringRecord", "clusterId":"cluster-
some_id
", "instanceId":"db-some_id
", "databaseActivityEventList":[ { "logTime":"2020-05-22 18:29:57.986467+00", "type":"record", "clientApplication":null, "pid":2830, "dbUserName":"master", "databaseName":"test", "remoteHost":"localhost", "remotePort":"11054", "command":"QUERY", "commandText":"SELECT * FROM test1 WHERE id < 28", "paramList":null, "objectType":"TABLE", "objectName":"test1", "statementId":65469218, "substatementId":1, "exitCode":"0", "sessionId":"726571", "rowCount":2, "serverHost":"master", "serverType":"MySQL", "serviceName":"Amazon Aurora MySQL", "serverVersion":"MySQL 5.7.12", "startTime":"2020-05-22 18:29:57.986364+00", "endTime":"2020-05-22 18:29:57.986467+00", "transactionId":"0", "dbProtocol":"MySQL", "netProtocol":"TCP", "errorMessage":"", "class":"MAIN" } ] }
以下示例显示 class
值为 AUX
的相应事件。
{ "type":"DatabaseActivityMonitoringRecord", "instanceId":"db-
some_id
", "databaseActivityEventList":[ { "logTime":"2020-05-22 18:29:57.986399+00", "type":"record", "clientApplication":null, "pid":2830, "dbUserName":"master", "databaseName":"test", "remoteHost":"localhost", "remotePort":"11054", "command":"READ", "commandText":"test1", "paramList":null, "objectType":"TABLE", "objectName":"test1", "statementId":65469218, "substatementId":2, "exitCode":"", "sessionId":"726571", "rowCount":0, "serverHost":"master", "serverType":"MySQL", "serviceName":"Amazon Aurora MySQL", "serverVersion":"MySQL 5.7.12", "startTime":"2020-05-22 18:29:57.986364+00", "endTime":"2020-05-22 18:29:57.986399+00", "transactionId":"0", "dbProtocol":"MySQL", "netProtocol":"TCP", "errorMessage":"", "class":"AUX" } ] }
DatabaseActivityMonitoringRecords JSON 对象
数据库活动事件记录位于包含以下信息的 JSON 对象中。
JSON 字段 | 数据类型 | 描述 |
---|---|---|
|
字符串 |
JSON 记录的类型。值为 |
version |
字符串 | 数据库活动监控记录的版本。 所生成数据库活动记录的版本取决于数据库集群的引擎版本:
除非另有注明,否则版本 1.0 和版本 1.1 中均包含以下所有字段。 |
字符串 |
包含活动事件的 JSON 对象。 |
|
键 | 字符串 | 用于解密 databaseActivityEventList JSON 数组 的加密密钥 |
databaseActivityEvents JSON 对象
databaseActivityEvents
JSON 对象包含以下信息。
JSON 记录中的顶级字段
审核日志中的每个事件都包装在 JSON 格式的记录中。此记录包含以下字段。
- 类型
-
此字段始终具有值
DatabaseActivityMonitoringRecords
。 - 版本
-
此字段表示数据库活动流数据协议或合同的版本。它定义了哪些字段可用。
版本 1.0 表示对 Aurora PostgreSQL 10.7 和 11.4 版的原始数据活动流支持。版本 1.1 表示对 Aurora PostgreSQL 10.10 版及更高版本和 Aurora PostgreSQL 11.5 版及更高版本的数据活动流支持。版本 1.1 包括其他字段
errorMessage
和startTime
。版本 1.2 表示对 Aurora MySQL 2.08 及更高版本的数据活动流支持。版本 1.2 包括其他字段endTime
和transactionId
。 - databaseActivityEvents
-
表示一个或多个活动事件的加密字符串。它表示为 base64 字节数组。解密字符串时,结果是 JSON 格式的记录,其中包含字段,如本节中的示例所示。
- key
-
用于加密
databaseActivityEvents
字符串的加密数据密钥。这与您在启动数据库活动流时提供的 Amazon KMS key 密钥相同。
以下示例显示了此记录的格式。
{ "type":"DatabaseActivityMonitoringRecords", "version":"1.1", "databaseActivityEvents":"
encrypted audit records
", "key":"encrypted key
" }
执行以下步骤来解密 databaseActivityEvents
字段的内容:
-
使用您在启动数据库活动流时提供的 KMS 密钥解密
key
JSON 字段中的值。这样做将以明文形式返回数据加密密钥。 -
对
databaseActivityEvents
JSON 字段中的值进行 Base64 解码,以获取审核负载的二进制格式的密文。 -
使用您在第一步中解码的数据加密密钥解密二进制密文。
-
解压解已解密的负载。
-
已加密的负载在
databaseActivityEvents
字段中。 -
databaseActivityEventList
字段包含审核记录数组。此数组中的type
字段可以是record
或heartbeat
。
-
审核日志活动事件记录是包含以下信息的 JSON 对象。
JSON 字段 | 数据类型 | 描述 |
---|---|---|
|
字符串 |
JSON 记录的类型。值为 |
clusterId |
字符串 | 数据库集群资源标识符。它对应于数据库集群属性 DbClusterResourceId 。 |
instanceId |
字符串 | 数据库实例资源标识符。它对应于数据库实例属性 DbiResourceId 。 |
字符串 |
活动审核记录或检测信号消息的数组。 |