I want to audit database activity for my Amazon Aurora Serverless DB clusters that run Amazon Aurora MySQL-Compatible Edition or Amazon Aurora PostgreSQL-Compatible Edition. I want to view and download the logs.
Resolution
For Aurora MySQL-Compatible DB clusters, you can turn on the slow query log, general log, or audit log. For Aurora PostgreSQL-Compatible DB clusters, you can use the log_statement parameter to control logs.
To view and download the logs, you must use Amazon CloudWatch. You can't view the logs directly from the Amazon Relational Database Service (Amazon RDS) console. There isn't a direct DB instance to access and host log files. Aurora Serverless connects to a proxy fleet of DB instances that scales automatically.
Activate logs
When you activate logs on Aurora Serverless v1, you must modify the cluster parameter groups for the DB cluster. For MySQL DB clusters, use an Aurora MySQL 5.6 or 5.7 cluster parameter group family. For PostgreSQL DB clusters, use an Aurora PostgreSQL 10 cluster parameter group family. When you activate logs on Aurora Serverless v2, you can modify the custom DB cluster parameter or the DB instance parameter group.
To activate logs on Aurora Serverless, complete the following steps:
- Create a custom DB cluster parameter group. Or, use the DB cluster's existing custom DB cluster parameter group.
- Modify the DB cluster parameter group values based on your DB cluster type.
MySQL DB clusters:
The error log is activated by default. To activate the slow query log and general log, configure the following settings:
general_log=1
slow_query_log=1
PostgreSQL DB clusters:
Use the log_statement parameter to determine the SQL statements that Aurora logs. The default value is none. To log the query and error logs, change the value all.
-or-
Modify your DB instance parameter group. When you use an instance parameter and set Source to Modified, Aurora ignores the parameter set on the cluster parameter group.
Note: If you're resolving issues in your DB instance, then it's a best practice to set log_statement to all to log all statements. To log all data definition language (DDL) statements, such as CREATE, ALTER, and DROP, set the parameter value to ddl. To log all DDL and data modification language (DML) statements, such as INSERT, UPDATE, and DELETE, set the parameter value to mod.
- Modify your DB cluster to use the custom DB cluster parameter group.
Aurora Serverless applies the parameter changes with an automatic seamless scale.
Note: Aurora Serverless V1 uses the ForceApplyCapacityChange timeout action when it applies the change. If your Aurora Serverless V1 DB cluster can't find a scaling point before it times out, then your connection might drop.
View the logs in CloudWatch
After you activate logs, Aurora Serverless automatically uploads the logs to CloudWatch.
To view and download the logs, complete the following steps:
- Open the CloudWatch console.
- In the navigation pane, choose Log groups.
- Select your log group.
For more information, see Monitoring log events in Amazon CloudWatch.
Related information
How can I turn on audit logging for my Amazon Aurora MySQL-Compatible DB cluster and publish the logs to CloudWatch?
How do I publish logs for Amazon RDS or Aurora MySQL-Compatible instances to CloudWatch?
Publishing Amazon Aurora MySQL logs to Amazon CloudWatch Logs
Publishing Aurora PostgreSQL logs to Amazon CloudWatch Logs
Publishing database logs to Amazon CloudWatch Logs