使用pg_query_audit函数查看数据库审计日志

1. 使用SQL客户端工具成功连接集群，连接方式请参考连接集群。
2. 使用函数pg_query_audit查询当前CN节点的审计日志：

   1	pg_query_audit(timestamptz startime,timestamptz endtime,audit_log)

   参数startime和endtime分别表示审计记录的开始时间和结束时间，audit_log表示所查看的审计日志信息所在的物理文件路径，当不指定audit_log时，默认查看连接当前实例的审计日志信息。

   例如，查看指定时间段当前CN节点审计记录。

   1	SELECT * FROM pg_query_audit('2021-02-23 21:49:00','2021-02-23 21:50:00');

   查询结果如下：

   1 2 3

   begintime | endtime | operation_type | audit_type | result | username | database | client_conninfo | object_name | command_text | detail_info | transaction_xid | query_id | node_name | session_id | local_port | remote_port ---------------------------+---------------------------+----------------+------------+--------+------------+----------+-----------------+-------------+-----------------+------------------------------------------------------------------+-----------------+----------+--------------+------------------------------+------------+------------- 2021-02-23 21:49:57.76+08 | 2021-02-23 21:49:57.82+08 | login_logout | user_login | ok | dbadmin | gaussdb | gsql@[local] | gaussdb | login db | login db(gaussdb) successfully, the current user is: dbadmin | 0 | 0 | coordinator1 | 140324035360512.667403397820909.coordinator1 | 27777 |

   该条记录表明，用户dbadmin在2021-02-23 21:49:57.82+08登录数据库gaussdb。其中client_conninfo字段在log_hostname启动且IP连接时，字符@后显示反向DNS查找得到的主机名。

3. 使用函数pgxc_query_audit可以查询所有CN节点的审计日志：

   1	pgxc_query_audit(timestamptz startime,timestamptz endtime)

   例如，查看指定时间段所有CN节点审计记录。

   1	SELECT * FROM pgxc_query_audit('2021-02-23 22:05:00','2021-02-23 22:07:00') where audit_type = 'user_login' and username = 'user1';

   查询结果如下：

   1 2 3 4

   begintime | endtime | operation_type | audit_type | result | username | database | client_conninfo | object_name | command_text | detail_info | transaction_xid | query_id | node_name | session_id | local_port | remote_port ----------------------------+----------------------------+----------------+------------+--------+----------+----------+-----------------+-------------+--------------+------------------------------------------------------------+-----------------+----------+--------------+----------------------------------------------+------------+------------- 2021-02-23 22:06:22.219+08 | 2021-02-23 22:06:22.271+08 | login_lgout | user_login | ok | user1 | gaussdb | gsql@[local] | gaussdb | login db | login db(gaussdb) successfully, the current user is: user1 | 0 | 0 | coordinator2 | 140689577342720.667404382271356.coordinator | 27782 | 2021-02-23 22:05:51.697+08 | 2021-02-23 22:05:51.749+08 | login_lgout | user_login | ok | user1 | gaussdb | gsql@[local] | gaussdb | login db | login db(gaussdb) successfully, the current user is: user1 | 0 | 0 | coordinator1 | 140525048424192.667404351749143.coordinator1 | 27777 |

   查询结果显示，用户user1在CN1和CN2的成功登录记录。

4. 查询审计多个对象名的记录。

   1 2	SET audit_object_name_format TO 'all'; SELECT object_name,result,operation_type,command_text FROM pgxc_query_audit('2022-08-26 8:00:00','2022-08-26 22:55:00') where command_text like '%student%';

   查询结果如下：

   1 2 3 4 5 6 7 8

   object_name | result | operation_type | command_text ------------------------------------------------------------------+--------+----------------+------------------------------------------------------------------------------------------------------------------ -------------------------------------------- student | ok | ddl | CREATE TABLE student(stuNo int, stuName TEXT); studentscore | ok | ddl | CREATE TABLE studentscore(stuNo int, stuscore int); ["public.student_view01","public.studentscore","public.student"] | ok | ddl | CREATE OR REPLACE VIEW student_view01 AS SELECT * FROM student t1 where t1.stuNo in (select stuNo from studentscore t2 where t1.stuNo = t2.stuNo); ["public.student_view01","public.student","public.studentscore"] | ok | dml | SELECT * FROM student_view01;

   查询结果object_name显示多个对象名，包括：表名、视图名及视图所涉及的基表名。