Untitled | Hyper-Converged Database

Audit logging event categories and types

All events have both a category and a type. A type usually maps directly to a CQL command. The following list shows all the types in each category.

Data Definition Language (DDL)

DDL (Data Definition Language) logs the following database schema changes:

Event category CQL commands

Event category	CQL commands
`ADD_KS`	CREATE KEYSPACE
`DROP_KS`	DROP KEYSPACE
`UPDATE_KS`	ALTER KEYSPACE
`ADD_CF`	CREATE TABLE
`DROP_CF`	DROP TABLE
`UPDATE_CF`	ALTER TABLE
`CREATE_INDEX`	CREATE INDEX
`DROP_INDEX`	DROP INDEX
`CREATE_TYPE`	CREATE TYPE
`DROP_TYPE`	DROP TYPE
`UPDATE_TYPE`	ALTER TYPE
`CREATE_FUNCTION`	CREATE FUNCTION
`DROP_FUNCTION`	DROP FUNCTION
`CREATE_AGGREGATE`	CREATE AGGREGATE
`DROP_AGGREGATE`	DROP AGGREGATE
`CREATE_MATERIALIZED_VIEW`	CREATE MATERIALIZED VIEW
`DROP_MATERIALIZED_VIEW`	DROP MATERIALIZED VIEW
`ALTER_MATERIALIZED_VIEW`	ALTER MATERIALIZED VIEW

ADD_KS

DROP_KS

UPDATE_KS

ADD_CF

DROP_CF

UPDATE_CF

CREATE_INDEX

DROP_INDEX

CREATE_TYPE

DROP_TYPE

UPDATE_TYPE

CREATE_FUNCTION

DROP_FUNCTION

CREATE_AGGREGATE

DROP_AGGREGATE

CREATE_MATERIALIZED_VIEW

CREATE MATERIALIZED VIEW

DROP_MATERIALIZED_VIEW

DROP MATERIALIZED VIEW

ALTER_MATERIALIZED_VIEW

ALTER MATERIALIZED VIEW

Data Manipulation Language (DML)

DML (Data Manipulation Language) logs the following database data changes:

Event category CQL command

Event category	CQL command
`SET_KS`	USE
`INSERT`	INSERT
`BATCH`	BATCH
`TRUNCATE`	TRUNCATE
`CQL_UPDATE`	UPDATE
`CQL_DELETE`	DELETE
`CQL_PREPARE_STATEMENT`	DataStax driver prepared statement, such as Java - Prepared Statement

SET_KS

INSERT

BATCH

TRUNCATE

CQL_UPDATE

CQL_DELETE

CQL_PREPARE_STATEMENT

DataStax driver prepared statement, such as Java - Prepared Statement

Data Control Language (DCL)

DCL (Data Control Language) logs the following database control, or role or permission changes:

Event category CQL command

Event category	CQL command
`CREATE_ROLE`	CREATE ROLE
`ALTER_ROLE`	ALTER ROLE
`DROP_ROLE`	DROP ROLE
`GRANT_ROLE`	GRANT ROLE
`REVOKE_ROLE`	REVOKE ROLE
`LIST_ROLES`	LIST ROLES
`LIST_USERS`	LIST USERS
`LIST_PERMISSIONS`	LIST PERMISSIONS
`GRANT_PERMISSION`	GRANT PERMISSION
`REVOKE_PERMISSION`	REVOKE PERMISSION
`RESTRICT`	RESTRICT
`UNRESTRICT`	UNRESTRICT
`RESTRICT_ROWS_STATEMENT`	RESTRICT ROWS
`UNRESTRICT_ROWS_STATEMENT`	UNRESTRICT ROWS

CREATE_ROLE

ALTER_ROLE

DROP_ROLE

GRANT_ROLE

REVOKE_ROLE

LIST_ROLES

LIST_USERS

LIST_PERMISSIONS

GRANT_PERMISSION

REVOKE_PERMISSION

RESTRICT

UNRESTRICT

RESTRICT_ROWS_STATEMENT

RESTRICT ROWS

UNRESTRICT_ROWS_STATEMENT

UNRESTRICT ROWS

QUERY

QUERY logs the following data retrieval events:

Event type CQL or other command

Event type	CQL or other command
`CQL_SELECT`	SELECT
`RPC_CALL_STATEMENT`	Remote Procedure Call (RPC) statement.

CQL_SELECT

SELECT

RPC_CALL_STATEMENT

Remote Procedure Call (RPC) statement.

AUTH

AUTH logs the following authentication and authorization events:

Event type CQLSH command

Event type	CQLSH command
`LOGIN_SUCCESS`	Successful login attempt. LOGIN and login requests sent from DataStax drivers.
`LOGIN_ERROR`	Failed login attempt.
`UNAUTHORIZED_ATTEMPT`	Unauthorized access attempt.

LOGIN_SUCCESS

Successful login attempt. LOGIN and login requests sent from DataStax drivers.

LOGIN_ERROR

Failed login attempt.

UNAUTHORIZED_ATTEMPT

Unauthorized access attempt.

HCD does not log AUTH messages, when whitelisting keyspaces; included_keyspaces.

ERROR

ERROR logs the following error events:

Event type Information

Event type	Information
ERROR	Logs `CQL` statement failures.
REQUEST_FAILURE	Logs failed requests.

ERROR

Logs CQL statement failures.

REQUEST_FAILURE

Logs failed requests.

UNKNOWN

UNKNOWN logs the following unknown events:

Event type Information

Event type	Information
`UNKNOWN`	Logs unknown events.

UNKNOWN

Logs unknown events.

Audit logging event categories and types

Data Definition Language (DDL)

Data Manipulation Language (DML)

Data Control Language (DCL)

QUERY

AUTH

ERROR

UNKNOWN

Was this helpful?

Give Feedback