Untitled | DataStax Enterprise

Filtering event categories

Configure which categories to capture in the audit_logging_options section of the dse.yaml file.

The location of the dse.yaml configuration file depends on the type of installation:

Package installations: /etc/dse/dse.yaml
Tarball installations: <installation_location>/resources/dse/conf/dse.yaml

audit_logging_options:
    enabled: true
    logger: <logger_name>
#    included_categories:
#    excluded_categories:

where <logger_name> is SLF4JAuditWriter or CassandraAuditWriter.

By default, DataStax Enterprise captures all event categories when auditing is enabled, and the following parameters are commented out. Use either the included_categories or excluded_categories parameter to limit which categories are captured.

included_categories - Includes only listed categories; excludes all others.
excluded_categories - Excludes listed categories; includes all others.

Audit logging event categories and types

All events have both a category and a type. A type usually maps directly to a CQL command. The following list shows all the types in each category.

Data Definition Language (DDL)

DDL (Data Definition Language) logs the following database schema changes:

Event category CQL or dsetool commands

Event category	CQL or `dsetool` commands
`ADD_KS`	CREATE KEYSPACE
`DROP_KS`	DROP KEYSPACE
`UPDATE_KS`	ALTER KEYSPACE
`ADD_CF`	CREATE TABLE
`DROP_CF`	DROP TABLE
`UPDATE_CF`	ALTER TABLE
`CREATE_INDEX`	CREATE INDEX
`DROP_INDEX`	DROP INDEX
`CREATE_TYPE`	CREATE TYPE
`DROP_TYPE`	DROP TYPE
`UPDATE_TYPE`	ALTER TYPE
`CREATE_FUNCTION`	CREATE FUNCTION
`DROP_FUNCTION`	DROP FUNCTION
`CREATE_AGGREGATE`	CREATE AGGREGATE
`DROP_AGGREGATE`	DROP AGGREGATE
`CREATE_VIEW`	CREATE VIEW
`DROP_VIEW`	DROP VIEW
`ALTER_VIEW`	ALTER VIEW
`CREATE_TRIGGER`	CREATE TRIGGER
`DROP_TRIGGER`	DROP TRIGGER
`SOLR_CREATE_SEARCH_INDEX_STATEMENT`	CREATE SEARCH INDEX
`SOLR_ALTER_SEARCH_INDEX_STATEMENT`	ALTER SEARCH INDEX CONFIG or ALTER SEARCH INDEX SCHEMA
`SOLR_DROP_SEARCH_INDEX_STATEMENT`	DROP SEARCH INDEX
`SOLR_RELOAD_SEARCH_INDEX`	RELOAD SEARCH INDEX
`SOLR_REBUILD_SEARCH_INDEX`	REBUILD SEARCH INDEX
`SOLR_GET_RESOURCE`	dsetool create_core
`SOLR_UPDATE_RESOURCE`	dsetool reload_core

ADD_KS

DROP_KS

UPDATE_KS

ADD_CF

DROP_CF

UPDATE_CF

CREATE_INDEX

DROP_INDEX

CREATE_TYPE

DROP_TYPE

UPDATE_TYPE

CREATE_FUNCTION

DROP_FUNCTION

CREATE_AGGREGATE

DROP_AGGREGATE

CREATE_VIEW

DROP_VIEW

ALTER_VIEW

CREATE_TRIGGER

DROP_TRIGGER

SOLR_CREATE_SEARCH_INDEX_STATEMENT

CREATE SEARCH INDEX

SOLR_ALTER_SEARCH_INDEX_STATEMENT

ALTER SEARCH INDEX CONFIG or ALTER SEARCH INDEX SCHEMA

SOLR_DROP_SEARCH_INDEX_STATEMENT

DROP SEARCH INDEX

SOLR_RELOAD_SEARCH_INDEX

RELOAD SEARCH INDEX

SOLR_REBUILD_SEARCH_INDEX

REBUILD SEARCH INDEX

SOLR_GET_RESOURCE

dsetool create_core

SOLR_UPDATE_RESOURCE

dsetool reload_core

Data Manipulation Language (DML)

DML (Data Manipulation Language) logs the following database data changes:

Event category CQL command

Event category	CQL command
`SET_KS`	USE
`INSERT`	INSERT
`BATCH`	BATCH
`TRUNCATE`	TRUNCATE
`CQL_UPDATE`	UPDATE
`CQL_DELETE`	DELETE
`CQL_PREPARE_STATEMENT`	DataStax driver prepared statement, such as Java - Prepared Statement
`SOLR_UPDATE`
`SOLR_COMMIT_SEARCH_INDEX_STATEMENT`	COMMIT SEARCH INDEX
`MANAGEMENT_API_OP`

SET_KS

INSERT

BATCH

TRUNCATE

CQL_UPDATE

CQL_DELETE

CQL_PREPARE_STATEMENT

DataStax driver prepared statement, such as Java - Prepared Statement

SOLR_UPDATE

SOLR_COMMIT_SEARCH_INDEX_STATEMENT

COMMIT SEARCH INDEX

MANAGEMENT_API_OP

Data Control Language (DCL)

DCL (Data Control Language) logs the following database control, or role or permission changes:

Event category CQL command

Event category	CQL command
`CREATE_ROLE`	CREATE ROLE
`ALTER_ROLE`	ALTER ROLE
`DROP_ROLE`	DROP ROLE
`LIST_ROLES`	LIST ROLES
`LIST_USERS`	LIST USERS
`LIST_PERMISSIONS`	LIST PERMISSIONS
`GRANT`	GRANT
`REVOKE`	REVOKE
`RESTRICT`	RESTRICT
`UNRESTRICT`	UNRESTRICT
`RESTRICT_ROWS_STATEMENT`	RESTRICT ROWS
`UNRESTRICT_ROWS_STATEMENT`	UNRESTRICT ROWS

CREATE_ROLE

ALTER_ROLE

DROP_ROLE

LIST_ROLES

LIST_USERS

LIST_PERMISSIONS

GRANT

REVOKE

RESTRICT

UNRESTRICT

RESTRICT_ROWS_STATEMENT

RESTRICT ROWS

UNRESTRICT_ROWS_STATEMENT

UNRESTRICT ROWS

QUERY

QUERY logs the following data retrieval events:

Event type CQL or other command

Event type	CQL or other command
`CQL_SELECT`	SELECT
`SOLR_QUERY`	SELECT statement filtered by the Search index.
`GRAPH_TINKERPOP_TRAVERSAL`	Calls to a table using the graph traversal instance (`g`). See Discovering properties about graphs and traversals.
`RPC_CALL_STATEMENT`	Remote Procedure Call (RPC) statement.

CQL_SELECT

SELECT

SOLR_QUERY

SELECT statement filtered by the Search index.

GRAPH_TINKERPOP_TRAVERSAL

Calls to a table using the graph traversal instance (g). See Discovering properties about graphs and traversals.

RPC_CALL_STATEMENT

Remote Procedure Call (RPC) statement.

ADMIN

ADMIN logs the following backup and restore events:

Event type CQL command or other information

Event type	CQL command or other information
`CREATE_BACKUP_CONFIG`	CREATE BACKUP CONFIGURATION
`DROP_BACKUP_CONFIG`	DROP BACKUP CONFIGURATION
`ALTER_BACKUP_CONFIG`	ALTER BACKUP CONFIGURATION
`LIST_BACKUP_CONFIGS`	LIST BACKUP CONFIGURATIONS
`ENABLE_BACKUP_CONFIG`	Enabling the backup and restore service
`DISABLE_BACKUP_CONFIG`	Enabling the backup and restore service
`CREATE_BACKUP_STORE`	CREATE BACKUP STORE
`DROP_BACKUP_STORE`	DROP BACKUP STORE
`ALTER_BACKUP_STORE`	ALTER BACKUP STORE
`LIST_BACKUP_STORES`	LIST BACKUP STORES
`VALIDATE_BACKUP_STORE`	VALIDATE BACKUP STORE
`RUN_BACKUP`	RUN BACKUP
`CANCEL_BACKUP`	CANCEL BACKUP
`RUN_RESTORE`	RESTORE
`CANCEL_RESTORE`	CANCEL RESTORE
`FORCE_RESTORE`	FORCE RESTORE
`LIST_BACKUPS`	LIST BACKUPS
`CLEAN_BACKUPS`	CLEAN BACKUPS

CREATE_BACKUP_CONFIG

CREATE BACKUP CONFIGURATION

DROP_BACKUP_CONFIG

DROP BACKUP CONFIGURATION

ALTER_BACKUP_CONFIG

ALTER BACKUP CONFIGURATION

LIST_BACKUP_CONFIGS

LIST BACKUP CONFIGURATIONS

ENABLE_BACKUP_CONFIG

Enabling the backup and restore service

DISABLE_BACKUP_CONFIG

Enabling the backup and restore service

CREATE_BACKUP_STORE

DROP_BACKUP_STORE

ALTER_BACKUP_STORE

LIST_BACKUP_STORES

VALIDATE_BACKUP_STORE

VALIDATE BACKUP STORE

RUN_BACKUP

CANCEL_BACKUP

RUN_RESTORE

CANCEL_RESTORE

FORCE_RESTORE

LIST_BACKUPS

CLEAN_BACKUPS

AUTH

AUTH logs the following authentication and authorization events:

Event type CQLSH command

Event type	CQLSH command
`LOGIN_SUCCESS`	Successful login attempt. LOGIN and login requests sent from DataStax drivers.
`LOGIN_ERROR`	Failed login attempt.
`UNAUTHORIZED_ATTEMPT`	Unauthorized access attempt.

LOGIN_SUCCESS

Successful login attempt. LOGIN and login requests sent from DataStax drivers.

LOGIN_ERROR

Failed login attempt.

UNAUTHORIZED_ATTEMPT

Unauthorized access attempt.

Messages not captured by DataStax Enterprise (DSE) include:

Successful Kerberos authentication events. You can audit Kerberos authentication from the Kerberos Distribution Server (KDS). DSE logs a failed Kerberos authentication request as type LOGIN_ERROR.
AUTH messages, when whitelisting keyspaces; included_keyspaces.

ERROR

ERROR logs the following error events:

Event type Information

Event type	Information
ERROR	Logs `CQL` statement failures.
REQUEST_FAILURE	Logs failed requests.

ERROR

Logs CQL statement failures.

REQUEST_FAILURE

Logs failed requests.

UNKNOWN

UNKNOWN logs the following unknown events:

Event type Information

Event type	Information
`UNKNOWN`	Logs unknown events.

UNKNOWN

Logs unknown events.

Example

Include only data retrieval and manipulation events:

audit_logging_options:
    enabled: true
    logger: SLF4JAuditWriter
    included_categories: QUERY, DDL, AUTH
#    excluded_categories:

Filtering event categories

Category types

Audit logging event categories and types

Data Definition Language (DDL)

Data Manipulation Language (DML)

Data Control Language (DCL)

QUERY

ADMIN

AUTH

ERROR

UNKNOWN

Example

Was this helpful?

Give Feedback