6.11. Query Audit#
Presto can log and keep an audit trail about query executions. It logs a timestamp value, the initiating user, the query ID and the SQL statement. Log entries are stored in textual format in log files that are automatically compressed and rotated at the end of a day.
The log file contains one log entry per line and the values are separated by a tab character. The timestamp is using ISO 8601 format.
2020-04-06T17:33:23+0000 admin 20200406_173323_00003_sae98 select * from customer
An alternative to the query audit feature is the more powerful Event Logger.
Query audit logging is implemented as a event listener and can be enabled by creating a configuration file
etc/event-listener.properties with the following properties.
||The name needs to be set to the
||Path of the security audit log file.||
||Maximum size of a single security audit log file.||100MB|
||Maximum number of security audit log files.||30|
||Optional log directory so that Amazon CloudWatch can use them.|
The CFT deployment automatically automatically configures query audit as part of the default configuration.