Untitled | Hyper-Converged Database

Filter event categories

Configure which categories to capture in the audit_logging_options section of the cassandra.yaml file.

The location of the cassandra.yaml configuration file depends on the type of installation:

Package installations: /etc/hcd/cassandra/cassandra.yaml
Tarball installations: <installation_location>/resources/cassandra/conf/cassandra.yaml

audit_logging_options:
    enabled: true
    logger:
      - class_name: <logger_name>
#    included_categories:
#    excluded_categories:

where <logger_name> is SLF4JAuditWriter or CassandraAuditWriter.

By default, HCD captures all event categories when auditing is enabled, and the following parameters are commented out. Use either the included_categories or excluded_categories parameter to limit which categories are captured.

included_categories - Includes only listed categories; excludes all others.
excluded_categories - Excludes listed categories; includes all others.

Audit logging event categories and types

All events have both a category and a type. A type usually maps directly to a CQL command. The following list shows all the types in each category.

Data Manipulation Language (DML)

DML (Data Manipulation Language) logs the following database data changes:

Event category CQL command

Event category	CQL command
`SET_KS`	USE
`INSERT`	INSERT
`BATCH`	BATCH
`TRUNCATE`	TRUNCATE
`CQL_UPDATE`	UPDATE
`CQL_DELETE`	DELETE
`CQL_PREPARE_STATEMENT`	DataStax driver prepared statement, such as Java - Prepared Statement
`SOLR_UPDATE`
`SOLR_COMMIT_SEARCH_INDEX_STATEMENT`	COMMIT SEARCH INDEX
`MANAGEMENT_API_OP`

SET_KS

INSERT

BATCH

TRUNCATE

CQL_UPDATE

CQL_DELETE

CQL_PREPARE_STATEMENT

DataStax driver prepared statement, such as Java - Prepared Statement

SOLR_UPDATE

SOLR_COMMIT_SEARCH_INDEX_STATEMENT

COMMIT SEARCH INDEX

MANAGEMENT_API_OP

Data Control Language (DCL)

DCL (Data Control Language) logs the following database control, or role or permission changes:

Event category CQL command

Event category	CQL command
`CREATE_ROLE`	CREATE ROLE
`ALTER_ROLE`	ALTER ROLE
`DROP_ROLE`	DROP ROLE
`LIST_ROLES`	LIST ROLES
`LIST_USERS`	LIST USERS
`LIST_PERMISSIONS`	LIST PERMISSIONS
`GRANT`	GRANT
`REVOKE`	REVOKE
`RESTRICT`	RESTRICT
`UNRESTRICT`	UNRESTRICT
`RESTRICT_ROWS_STATEMENT`	RESTRICT ROWS
`UNRESTRICT_ROWS_STATEMENT`	UNRESTRICT ROWS

CREATE_ROLE

ALTER_ROLE

DROP_ROLE

LIST_ROLES

LIST_USERS

LIST_PERMISSIONS

GRANT

REVOKE

RESTRICT

UNRESTRICT

RESTRICT_ROWS_STATEMENT

RESTRICT ROWS

UNRESTRICT_ROWS_STATEMENT

UNRESTRICT ROWS

QUERY

QUERY logs the following data retrieval events:

Event type CQL or other command

Event type	CQL or other command
`CQL_SELECT`	SELECT
`SOLR_QUERY`	SELECT statement filtered by the Search index.
`GRAPH_TINKERPOP_TRAVERSAL`	Calls to a table using the graph traversal instance (`g`). See Discovering properties about graphs and traversals.
`RPC_CALL_STATEMENT`	Remote Procedure Call (RPC) statement.

CQL_SELECT

SELECT

SOLR_QUERY

SELECT statement filtered by the Search index.

GRAPH_TINKERPOP_TRAVERSAL

Calls to a table using the graph traversal instance (g). See Discovering properties about graphs and traversals.

RPC_CALL_STATEMENT

Remote Procedure Call (RPC) statement.

AUTH

AUTH logs the following authentication and authorization events:

Event type CQLSH command

Event type	CQLSH command
`LOGIN_SUCCESS`	Successful login attempt. LOGIN and login requests sent from DataStax drivers.
`LOGIN_ERROR`	Failed login attempt.
`UNAUTHORIZED_ATTEMPT`	Unauthorized access attempt.

LOGIN_SUCCESS

Successful login attempt. LOGIN and login requests sent from DataStax drivers.

LOGIN_ERROR

Failed login attempt.

UNAUTHORIZED_ATTEMPT

Unauthorized access attempt.

ERROR

ERROR logs the following error events:

Event type Information

Event type	Information
ERROR	Logs `CQL` statement failures.
REQUEST_FAILURE	Logs failed requests.

ERROR

Logs CQL statement failures.

REQUEST_FAILURE

Logs failed requests.

UNKNOWN

UNKNOWN logs the following unknown events:

Event type Information

Event type	Information
`UNKNOWN`	Logs unknown events.

UNKNOWN

Logs unknown events.

Example

Include only data retrieval and manipulation events:

audit_logging_options:
    enabled: true
    logger:
      - class_name: SLF4JAuditWriter
    included_categories: QUERY, DDL, AUTH
#    excluded_categories:

Filter event categories

Category types

Audit logging event categories and types

Data Manipulation Language (DML)

Data Control Language (DCL)

QUERY

AUTH

ERROR

UNKNOWN

Example

Was this helpful?

Give Feedback