Adding Audit Scope

By default, database audit complies with a full audit rule, which is used to audit all databases that are connected to the database audit instance. You can also add audit scope and specify the databases to be audited.

By default, the full audit rule takes effect even if other rules exist. To make another audit rule take effect, disable the full audit rule first.

Prerequisites

Procedure

  1. Log in to the management console.
  2. Select a region, click , and choose Security > Database Security Service. The Dashboard page is displayed.
  3. In the navigation tree on the left, choose Audit Rules.
  4. In the Instance drop-down list, select an instance to add audit scope.
  5. Add Audit Scope above the audit scope list.

    • By default, database audit complies with a full audit rule, which is used to audit all databases that are connected to the database audit instance. This audit rule is enabled by default. You can disable it but cannot delete it.
    • To make a custom rule take effect, disable the full audit rule first.

  6. In the displayed dialog box, set the audit scope, as shown in Figure 1. For details about related parameters, see Table 1.

    Figure 1 Add Audit Scope dialog box
    Table 1 Parameters

    Parameter

    Description

    Example Value

    Name

    Name of the custom audit scope

    audit00

    Database Name

    Database to be added to the audit scope

    db03

    Operations

    Audited operation type. It can be Login or Operation.

    When you select the Operation check box, you can select All operations or the operations in DDL, DML, and DCL.

    Login

    Database Account

    (Optional) Database username.

    You can specify multiple accounts, separated by commas (,).

    -

    Exception IP Address

    (Optional) IP addresses that do not need to be audited.

    NOTE:

    If an IP address is set as both a source and an exception IP address, the IP address will not be audited.

    -

    Source IP Address

    (Optional) IP address or IP address range used for accessing the database to be audited

    The entered IP address is not the IP address of the database selected in Database Name.

    The IP address must be an internal IP address in IPv4 or IPv6 format.

    -

    Source Port

    (Optional) Port number used for accessing the database to be audited

    The entered port number is not the port number of the database selected in Database Name.

    -

  7. Click OK.

    When the audit scope is added successfully, it is displayed in the audit scope list in the state of Enabled.

Related Operations

In addition to adding the audit scope, you can enable or disable SQL injection detection and add risky operations to set audit rules for database audit.