|
| 1 | +--- |
| 2 | +{ |
| 3 | + "title": "Audit log plugin", |
| 4 | + "language": "en" |
| 5 | +} |
| 6 | +--- |
| 7 | + |
| 8 | +<!- |
| 9 | +Licensed to the Apache Software Foundation (ASF) under one |
| 10 | +or more contributor license agreements. See the NOTICE file |
| 11 | +distributed with this work for additional information |
| 12 | +regarding copyright ownership. The ASF licenses this file |
| 13 | +to you under the Apache License, Version 2.0 (the |
| 14 | +"License"); you may not use this file except in compliance |
| 15 | +with the License. You may obtain a copy of the License at |
| 16 | + |
| 17 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 18 | + |
| 19 | +Unless required by applicable law or agreed to in writing, |
| 20 | +software distributed under the License is distributed on an |
| 21 | +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 22 | +KIND, either express or implied. See the License for the |
| 23 | +specific language governing permissions and limitations |
| 24 | +under the License. |
| 25 | +-> |
| 26 | + |
| 27 | +# Audit log plugin |
| 28 | + |
| 29 | +Doris's audit log plugin was developed based on FE's plugin framework. Is an optional plugin. Users can install or uninstall this plugin at runtime. |
| 30 | + |
| 31 | +This plugin can periodically import the FE audit log into the specified Doris cluster, so that users can easily view and analyze the audit log through SQL. |
| 32 | + |
| 33 | +## Compile, Configure and Deploy |
| 34 | + |
| 35 | +### FE Configuration |
| 36 | + |
| 37 | +FE's plugin framework is an experimental feature, which is closed by default. In the FE configuration file, add `plugin_enable = true` to enable the plugin framework. |
| 38 | + |
| 39 | +### AuditLoader Configuration |
| 40 | + |
| 41 | +The configuration of the auditloader plugin is located in `$ {DORIS}/fe_plugins/auditloader/src/main/assembly/`. |
| 42 | + |
| 43 | +Open `plugin.conf` for configuration. See the comments of the configuration items. |
| 44 | + |
| 45 | +### Compile |
| 46 | + |
| 47 | +After executing `sh build_plugin.sh` in the Doris code directory, you will get the `auditloader.zip` file in the `fe_plugins/output` directory. |
| 48 | + |
| 49 | +### Deployment |
| 50 | + |
| 51 | +You can place this file on an http download server or copy(or unzip) it to the specified directory of all FEs. Here we use the latter. |
| 52 | + |
| 53 | +### Installation |
| 54 | + |
| 55 | +After deployment is complete, and before installing the plugin, you need to create the audit database and tables previously specified in `plugin.conf`. The table creation statement is as follows: |
| 56 | + |
| 57 | +``` |
| 58 | +create table doris_audit_tbl__ |
| 59 | +( |
| 60 | + query_id varchar(48) comment "Unique query id", |
| 61 | + `time` datetime not null comment "Query start time", |
| 62 | + client_ip varchar(32) comment "Client IP", |
| 63 | + user varchar(64) comment "User name", |
| 64 | + db varchar(96) comment "Database of this query", |
| 65 | + state varchar(8) comment "Query result state. EOF, ERR, OK", |
| 66 | + query_time bigint comment "Query execution time in millisecond", |
| 67 | + scan_bytes bigint comment "Total scan bytes of this query", |
| 68 | + scan_rows bigint comment "Total scan rows of this query", |
| 69 | + return_rows bigint comment "Returned rows of this query", |
| 70 | + stmt_id int comment "An incremental id of statement", |
| 71 | + is_query tinyint comment "Is this statemt a query. 1 or 0", |
| 72 | + frontend_ip varchar(32) comment "Frontend ip of executing this statement", |
| 73 | + cpu_time_ms bigint comment "Total scan cpu time in millisecond of this query", |
| 74 | + sql_hash varchar(50) comment "Hash value for this query", |
| 75 | + sql_digest varchar(48) comment "Sql digest for this query", |
| 76 | + peak_memory_bytes bigint comment "Peak memory bytes used on all backends of this query", |
| 77 | + stmt string comment "The original statement, trimed if longer than 2G" |
| 78 | +) engine=OLAP |
| 79 | +duplicate key(query_id, `time`, client_ip) |
| 80 | +partition by range(`time`) () |
| 81 | +distributed by hash(query_id) buckets 1 |
| 82 | +properties( |
| 83 | + "dynamic_partition.time_unit" = "DAY", |
| 84 | + "dynamic_partition.start" = "-30", |
| 85 | + "dynamic_partition.end" = "3", |
| 86 | + "dynamic_partition.prefix" = "p", |
| 87 | + "dynamic_partition.buckets" = "1", |
| 88 | + "dynamic_partition.enable" = "true", |
| 89 | + "replication_num" = "3" |
| 90 | +); |
| 91 | +``` |
| 92 | + |
| 93 | +>**Notice** |
| 94 | +> |
| 95 | +> In the above table structure: stmt string, this can only be used in 0.15 and later versions, in previous versions, the field type used varchar |
| 96 | +
|
| 97 | +The `dynamic_partition` attribute selects the number of days to keep the audit log based on your needs. |
| 98 | + |
| 99 | +After that, connect to Doris and use the `INSTALL PLUGIN` command to complete the installation. After successful installation, you can see the installed plug-ins through `SHOW PLUGINS`, and the status is `INSTALLED`. |
| 100 | + |
| 101 | +Upon completion, the plug-in will continuously import audit date into this table at specified intervals. |
0 commit comments