Audit and Compliance

ENTERPRISE FEATURE

The features or components discussed in this document are available in TDengine TSDB-Enterprise only. TDengine TSDB-OSS does not include these features or components.

TDengine records user operations and sends them to taosKeeper, which stores the audit logs in a TDengine cluster. Starting with v3.4.1.0, audit records can instead be stored in the local cluster by enabling auditSaveInSelf. For authoritative parameter details, see taosd.

In this document, “compliance” means supporting internal audits and operational traceability with configurable audit trails, and applying fixes published in Security Advisories. It does not claim compliance with a specific external certification or regulation.

Audit Logs

TDengine first records and manages user operations, then sends these as audit logs to taosKeeper, which then saves them to any TDengine cluster. Administrators can use audit logs for security monitoring and historical tracing. Enabling and disabling TDengine's audit log feature is very simple, just modify the TDengine configuration file and restart the service. The configuration details for audit logs are as follows.

taosd Configuration

Audit logs are generated by the database service taosd, and its relevant parameters need to be configured in the taos.cfg configuration file, detailed parameters are as follows.

Parameter Name	Parameter Meaning
audit	Whether to enable audit logs. Enterprise default: 1; 1 enables and 0 disables auditing
monitorFqdn	FQDN of the taosKeeper server receiving audit logs
monitorPort	Port of the taosKeeper service receiving audit logs
monitorCompaction	Whether to compress data during reporting
auditLevel	Audit level controlling which operations are recorded. Default 3 (database level), starting with v3.4.0.0
auditHttps	Whether to use HTTPS when sending audit records to taosKeeper. Default 0, starting with v3.4.0.0
auditUseToken	Whether to authenticate reports with a token. Default 1, starting with v3.4.0.0
auditCreateTable	Whether to audit child-table creation. Default 1
auditSaveInSelf	Whether to store audit records in the local cluster instead of sending them to taosKeeper. Default 0, starting with v3.4.1.0

For types, ranges, and dynamic-modification support, see the taosd reference.

create audit database

Audit database need to be created after audit is set, and parameter is_audit need to be set.

CREATE DATABASE [IF NOT EXISTS] db_name [database_options] IS_AUDIT 1;

database_options:
    database_option ...

database_option: {
  DURATION value
}

database_option: {
  WAL_LEVEL value
}

database_option: {
  ENCRYPT_ALGORITHM value
}

Additionally, for an audit database:

• The default value for keep is 1825 days. If a user specifies keep, it must be greater than 1825 days.
• WAL_LEVEL defaults to 2 and cannot be changed by the user.
• ENCRYPT_ALGORITHM cannot be specified as None. The user can choose any symmetric encryption algorithm in CBC mode.
• PRECISION defaults to nanosecond (ns) and cannot be changed to other precisions.

Audit databases created before v3.4.0.0 are incompatible with audit features in v3.4.0.0 and later. In older versions, the is_audit parameter was not enforced, so there were no mandatory requirements for DURATION, WAL_LEVEL, and ENCRYPT_ALGORITHM. To enable new audit features for an old audit database, it must be dropped and recreated. As a workaround to access data from a pre-v3.4.0.0 audit database in a newer version (without new audit features), you can disable auditUseToken by setting it to 0.

In v3.4.1.0 and later, audit information can be saved locally rather than sent to taosKeeper. To use this functionality, set auditSaveInSelf to 1; the audit database must have exactly one vgroup.

taosKeeper Configuration

Configure the related parameters for audit logs in the taosKeeper configuration file keeper.toml, as shown in the table below

Parameter Name	Description
auditDB	The name of the database used to store audit logs, default is "audit". taosKeeper will check if this database exists upon receiving audit logs, and will create it automatically if it does not exist.

Data Format

The format of the reported audit logs is as follows

{
    "ts": timestamp,
    "cluster_id": string,
    "user": string,
    "operation": string,
    "db": string,
    "resource": string,
    "client_add": string,
    "details": string,
    "affected_rows": integer,
    "duration": double
}

Table Structure

taosKeeper will automatically create a supertable in the corresponding database based on the reported audit data to store the data. The definition of this supertable is as follows:

create stable operations (ts timestamp, user_name varchar(25), operation varchar(20), db varchar(65), resource varchar(193), client_address varchar(64), details varchar(50000)) tags (cluster_id varchar(64))

Where:

1. db refers to the database involved in the operation, resource refers to the resource involved.
2. user_name and operation are data columns, indicating which user performed what operation on the object.
3. ts is the timestamp column, indicating the time when the operation occurred.
4. details provide additional details of the operation, which in most cases is the SQL statement executed.
5. client_address is the client address, including IP and port.

Operation List

The current list of operations recorded in the audit logs and the meanings of each field in each operation are shown in the table below (Note: since the user field, timestamp, and client_add have the same meaning in all operations, they are not included in the table below)

auditLevel = 1 // AUDIT_LEVEL_SYSTEM

Operation	Operation	DB	Resource	Details
create dnode	createDnode	NULL	IP:Port or FQDN:Port	SQL
drop dnode	dropDnode	NULL	dnodeId	SQL
alter dnode	alterDnode	NULL	dnodeId	SQL
create mnode	createMnode	NULL	dnodeId	SQL
drop mnode	dropMnode	NULL	dnodeId	SQL
create qnode	createQnode	NULL	dnodeId	SQL
drop qnode	dropQnode	NULL	dnodeId	SQL
restore dnode	restoreDnode	NULL	dnodeId	SQL

auditLevel = 2 // AUDIT_LEVEL_CLUSTER

Operation	Operation	DB	Resource	Details
alter cluster	alterCluster	NULL	NULL	SQL
balance vgroup leader	balanceVgroupLead	NULL	NULL	SQL
redistribute vgroup	redistributeVgroup	NULL	vgroupId	SQL
balance vgroup	balanceVgroup	NULL	vgroupId	SQL
assign leader	assignLeader	NULL	NULL	SQL
grant privileges	grantPrivileges	NULL	user granted	SQL
revoke privileges	revokePrivileges	NULL	user whose privileges were revoked	SQL
login	login	NULL	NULL	appName
create user	createUser	NULL	username being created	User attribute parameters, (excluding password)
alter user	alterUser	NULL	username being modified	Password change logs the modified parameters and new values (excluding password); other operations log SQL
drop user	dropUser	NULL	username being deleted	SQL
create mount	createMount	mountName	NULL	SQL
drop mount	dropMount	mountName	NULL	SQL
kill retention	killRetention	db name	NULL	SQL
auto trimDB	autoTrimDB	db name	NULL	SQL
create encrypt algr	createEncryptAlgr	NULL	algorithmId	SQL
drop encrypt algr	dropEncryptAlgr	NULL	algorithmId	SQL

auditLevel = 3 // AUDIT_LEVEL_DATABASE

Operation	Operation	DB	Resource	Details
create database	createDB	db name	NULL	SQL
alter database	alterDB	db name	NULL	SQL
drop database	dropDB	db name	NULL	SQL
compact database	compact	database name	NULL	SQL
kill compact	killCompact	db name	NULL	SQL
create stable	createStb	db name	stable name	SQL
alter stable	alterStb	db name	stable name	SQL
drop stable	dropStb	db name	stable name	SQL
create stream	createStream	NULL	name of the created stream	SQL
drop stream	dropStream	NULL	name of the deleted stream	SQL
recalc stream	recalcStream	streamName	recalcName	SQL
create topic	createTopic	topic's DB	name of the created topic	SQL
drop topic	dropTopic	topic's DB	name of the deleted topic	SQL
reload topic	reloadTopic	topic's DB	name of the topic	SQL
create Rsma	createRsma	Rsma name	NULL	SQL
alter Rsma	alterRsma	Rsma name	Table name	SQL
drop Rsma	dropRsma	Rsma name	NULL	SQL
create View	createView	Db name	NULL	SQL
drop View	dropView	Db name	view name	SQL

auditLevel = 4 // AUDIT_LEVEL_CHILDTABLE

Operation	Operation	DB	Resource	Details
create table	createTable	db name	table name	SQL
drop table	dropTable	db name	table name	SQL

View Audit Logs

After both taosd and taosKeeper are correctly configured and started, as the system continues to operate, various operations (as shown in the table above) will be recorded and reported in real-time. Users can log in to taosExplorer, click on "System Management" > "Audit" page to view the audit logs; they can also directly query the relevant databases and tables in the TDengine CLI.

Security Advisories and Vulnerability Disclosure

Known security vulnerabilities, affected versions, and fixes are published on Security Advisories. If you discover an undisclosed vulnerability, report it privately using the channels on that page; do not discuss unfixed issues in public forums or issues.

For hardening and deployment guidance, see Security Deployment Suggestions.