Query audit#

Starburst Enterprise platform (SEP) can log and keep an audit trail about query executions. It logs a timestamp value, the initiating user, the query ID and the SQL statement. Log entries are stored in textual format in log files that are automatically compressed and rotated at the end of a day.

Note

Query audit logger requires a valid Starburst Enterprise license.

The log file contains one log entry per line and the values are separated by a tab character. The timestamp is using ISO 8601 format.

2020-04-06T17:33:23+0000    admin   20200406_173323_00003_sae98    select * from customer

Note

An improved alternative to the query audit feature is provided by the backend service. It includes access to data in Insights query overview.

Query audit logging is implemented as a event listener and can be enabled by creating a configuration file called etc/event-listener.properties with the following properties.

Query audit configuration properties#

Property name

Description

event-listener.name

The name needs to be set to the audit-log value.

audit-log.path

Path of the security audit log file. Defaults to var/log/starburst/security.log

audit-log.max-size

Maximum size of a single security audit log file. Defaults to 100MB.

audit-log.max-history

Maximum number of security audit log files. Defaults to 30.

cloud-watch-logs-directory

Optional log directory so that Amazon CloudWatch can use them.

The CFT deployment automatically configures query audit as part of the default configuration.