Clarification on Disabling Audit Logs & CloudWatch Cost Calculation

Yes, your current understanding is mostly correct, but there are a few additional steps required to completely stop the logs from being published and to accurately measure costs.

1. Is audit logging considered fully disabled when server_audit_logging = 0?

Yes. The server_audit_logging parameter acts as the master switch. When it is set to 0 (disabled), the database engine stops evaluating and recording audit events entirely, regardless of what server_audit_events is set to. You do not need to worry about the CONNECT value remaining there.

2. Why are logs still visible in CloudWatch after disabling?

If you are still seeing logs, it is usually due to one of three reasons:

• Apply Status: Parameter group changes can be applied "Immediately" or "During the next maintenance window." Check the RDS console to ensure the parameter group status is in-sync and not pending-reboot.

• Ingestion Delay: CloudWatch batches and forwards logs asynchronously. You might be seeing the tail end of logs that were generated just before you disabled the parameter. Check the actual timestamp inside the log event, not just the ingestion timestamp.

• Active Log Export: Even if the DB stops generating new audit entries, if the RDS instance is still configured to export audit logs, the CloudWatch agent on the underlying host remains active and might still push empty log streams or keep the connection open.

3. Is there any additional step required to completely stop audit logs? Yes. Setting the parameter to 0 stops the database from writing the logs, but you must also tell RDS to stop pushing log files to CloudWatch.

• Go to the RDS Console -> Select your Database -> Click Modify.
• Scroll down to the Log exports section.
• Uncheck the box for Audit log.
• Apply the modification (this can safely be applied immediately without downtime).

(Note: To completely uninstall the audit feature rather than just disabling it, you should modify your RDS Option Group and remove the MARIADB_AUDIT_PLUGIN entirely. This ensures no overhead is left on the instance).

4. How can we calculate the CloudWatch cost incurred for audit logs?

CloudWatch Logs pricing is primarily based on Data Ingested (per GB). The most accurate way to calculate the cost for that specific period is via CloudWatch Metrics:

1. Go to the CloudWatch Console -> Metrics -> All metrics.

2. Select Logs -> Log Group Metrics.

3. Find the specific log group for your audit logs (e.g., /aws/rds/instance/your-db-name/audit).

4. Graph the IncomingBytes metric. Set the time range to your exact testing period and set the statistic to Sum.

5. Convert the total bytes to Gigabytes (GB) and multiply it by your region's CloudWatch ingestion price (e.g., ~$0.50 per GB, depending on your AWS region).

(Note: You can also use AWS Cost Explorer filtered by the CloudWatch service, but finding the exact cost of a single Log Group there usually requires having active Cost Allocation Tags on that specific Log Group).