ScyllaDB Auditing Guide¶

audit_categories parameter description¶

Note that audit for every DML or QUERY might impact performance and consume a lot of storage.

Storing Audit Messages in Syslog¶

Procedure

1. Set the audit parameter in the scylla.yaml file to syslog.

   For example:

   # audit setting
   # by default, Scylla does not audit anything.
   # It is possible to enable auditing to the following places:
   #   - audit.audit_log column family by setting the flag to "table"
   audit: "syslog"
   #
   # List of statement categories that should be audited.
   audit_categories: "DCL,DDL,AUTH"
   #
   # List of tables that should be audited.
   audit_tables: "mykespace.mytable"
   #
   # List of keyspaces that should be fully audited.
   # All tables in those keyspaces will be audited
   audit_keyspaces: "mykespace"
   

2. Restart the Scylla node.

sudo systemctl restart scylla-server

docker exec -it some-scylla supervisorctl restart scylla

By default, audit messages are written to the same destination as Scylla logging, with scylla-audit as the process name.

Logging output example (drop table):

Mar 18 09:53:52 ip-10-143-2-108 scylla-audit[28387]: "10.143.2.108", "DDL", "ONE", "team_roster", "nba", "DROP TABLE nba.team_roster ;", "127.0.0.1", "anonymous", "false"

To redirect the Syslog output to a file, follow the steps below (available only for CentOS) :

1. Install rsyslog sudo dnf install rsyslog.

2. Edit /etc/rsyslog.conf and append the following to the file: if $programname contains 'scylla-audit' then /var/log/scylla-audit.log.

3. Start rsyslog systemctl start rsyslog.

4. Enable rsyslog systemctl enable rsyslog.

Storing Audit Messages in a Table¶

Messages are stored in a Scylla table named audit.audit_log.

For example:

CREATE TABLE IF NOT EXISTS audit.audit_log (
      date timestamp,
      node inet,
      event_time timeuuid,
      category text,
      consistency text,
      table_name text,
      keyspace_name text,
      operation text,
      source inet,
      username text,
      error boolean,
      PRIMARY KEY ((date, node), event_time));

Procedure

1. Set the audit parameter in the scylla.yaml file to table.

   For example:

   # audit setting
   # by default, Scylla does not audit anything.
   # It is possible to enable auditing to the following places:
   #   - audit.audit_log column family by setting the flag to "table"
   audit: "table"
   #
   # List of statement categories that should be audited.
   audit_categories: "DCL,DDL,AUTH"
   #
   # List of tables that should be audited.
   audit_tables: "mykespace.mytable"
   #
   # List of keyspaces that should be fully audited.
   # All tables in those keyspaces will be audited
   audit_keyspaces: "mykespace"
   

2. Restart Scylla node.

   Supported OSDocker

   sudo systemctl restart scylla-server
   

   Table output example (drop table):

   SELECT * FROM audit.audit_log ;
   

   returns:

    date                    | node         | event_time                           | category | consistency | error | keyspace_name | operation                    | source          | table_name  | username |
   -------------------------+--------------+--------------------------------------+----------+-------------+-------+---------------+------------------------------+-----------------+-------------+----------+
   2018-03-18 00:00:00+0000 | 10.143.2.108 | 3429b1a5-2a94-11e8-8f4e-000000000001 |      DDL |         ONE | False |           nba | DROP TABLE nba.team_roster ; | 127.0.0.1       | team_roster | Scylla   |
   (1 row)