Skip to content

Commit 4828969

Browse files
committed
[feature](audit) add new FE config to skip audit for certain user (apache#38310)
Sometime we don't want to audit operation from certain user in audit log or audit table. Add a new FE config `skip_audit_user_list`. Default is empty, which means all operations will be recorded. When you want to ignore some user's operation, you can set this config like: ``` skip_audit_user_list=user1 --or skip_audit_user_list=user1,user2 ```
1 parent 9470d6a commit 4828969

File tree

2 files changed

+29
-0
lines changed

2 files changed

+29
-0
lines changed

fe/fe-common/src/main/java/org/apache/doris/common/Config.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2531,6 +2531,13 @@ public class Config extends ConfigBase {
25312531
@ConfField(mutable = true)
25322532
public static int query_audit_log_timeout_ms = 5000;
25332533

2534+
@ConfField(description = {
2535+
"在这个列表中的用户的操作,不会被记录到审计日志中。多个用户之间用逗号分隔。",
2536+
"The operations of the users in this list will not be recorded in the audit log. "
2537+
+ "Multiple users are separated by commas."
2538+
})
2539+
public static String skip_audit_user_list = "";
2540+
25342541
@ConfField(mutable = true)
25352542
public static int be_report_query_statistics_timeout_ms = 60000;
25362543

fe/fe-core/src/main/java/org/apache/doris/qe/AuditEventProcessor.java

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,17 +17,21 @@
1717

1818
package org.apache.doris.qe;
1919

20+
import org.apache.doris.common.Config;
2021
import org.apache.doris.plugin.AuditPlugin;
2122
import org.apache.doris.plugin.Plugin;
2223
import org.apache.doris.plugin.PluginInfo.PluginType;
2324
import org.apache.doris.plugin.PluginMgr;
2425
import org.apache.doris.plugin.audit.AuditEvent;
2526

27+
import com.google.common.base.Strings;
2628
import com.google.common.collect.Queues;
29+
import com.google.common.collect.Sets;
2730
import org.apache.logging.log4j.LogManager;
2831
import org.apache.logging.log4j.Logger;
2932

3033
import java.util.List;
34+
import java.util.Set;
3135
import java.util.concurrent.BlockingQueue;
3236
import java.util.concurrent.TimeUnit;
3337

@@ -49,16 +53,30 @@ public class AuditEventProcessor {
4953

5054
private volatile boolean isStopped = false;
5155

56+
private Set<String> skipAuditUsers = Sets.newHashSet();
57+
5258
public AuditEventProcessor(PluginMgr pluginMgr) {
5359
this.pluginMgr = pluginMgr;
5460
}
5561

5662
public void start() {
63+
initSkipAuditUsers();
5764
workerThread = new Thread(new Worker(), "AuditEventProcessor");
5865
workerThread.setDaemon(true);
5966
workerThread.start();
6067
}
6168

69+
private void initSkipAuditUsers() {
70+
if (Strings.isNullOrEmpty(Config.skip_audit_user_list)) {
71+
return;
72+
}
73+
String[] users = Config.skip_audit_user_list.replaceAll(" ", "").split(",");
74+
for (String user : users) {
75+
skipAuditUsers.add(user);
76+
}
77+
LOG.info("skip audit users: {}", skipAuditUsers);
78+
}
79+
6280
public void stop() {
6381
isStopped = true;
6482
if (workerThread != null) {
@@ -75,6 +93,10 @@ public boolean handleAuditEvent(AuditEvent auditEvent) {
7593
}
7694

7795
public boolean handleAuditEvent(AuditEvent auditEvent, boolean ignoreQueueFullLog) {
96+
if (skipAuditUsers.contains(auditEvent.user)) {
97+
// return true to ignore this event
98+
return true;
99+
}
78100
boolean isAddSucc = true;
79101
try {
80102
eventQueue.add(auditEvent);

0 commit comments

Comments
 (0)