修改kingbase.conf文件
vim kingbase.conf
shared_preload_libraries=‘sysaudit’
sys_ctl -D /home/kingbase/ES/V8/data restart
加载插件
create extension sysaudit;
show sysaudit.enable;
打开审计开关,使用sao用户操作
ksql test sao
alter system set sysaudit.enable=on;
select sys_reload_conf();
事件审计(服务器启停、重载配置)
show sysaudit.serverevent ;
语句审计
test库中创建审计规则,记录system用户创建、修改表的动作
ksql test sao
select sysaudit.set_audit_stmt(‘CREATE TABLE’,‘system’,null,null);
select sysaudit.set_audit_stmt(‘ALTER TABLE’,‘system’,null,null);
select * from sysaudit.all_audit_rules;
查看审计记录
\c security sao
select username,remote_addr,db_name,rule_type,opr_type,result,aud_client from sysaudit_record_sao;
删除审计
select * from sysaudit.all_audit_rules;
CALL sysaudit.remove_audit(13695);
模式对象审计
test库中创建审计规则,记录user01用户对public模式中t01表的操作 #普通用户审计需要使用sso用户
ksql test sso
select sysaudit.set_audit_object(‘table’,‘user01’,‘public’,‘t01’);
select sysaudit.set_audit_object(‘table’,‘user01’,‘public’,null); --所有表
select * from sysaudit.all_audit_rules;
查看审计记录
\c security sso
select username,remote_addr,db_name,rule_type,opr_type,result,aud_client from sysaudit_record_sso;
删除审计
select * from sysaudit.all_audit_rules;
CALL sysaudit.remove_audit(16407);