Enable the audit log feature - Tair (Redis® OSS-Compatible)

Tair (Redis OSS-compatible) provides the audit log feature based on Simple Log Service. This feature allows you to query, analyze, and export log data. Security auditors can use the feature to promptly detect unusual or unauthorized data manipulation activities, and rapidly pinpoint the identity of the user who altered the data and the exact time of alteration. Developers and O&M personnel can use the feature to identify performance-related issues. This feature also empowers business systems to meet security and compliance requirements.

Prerequisites

To enable the audit log feature, a Resource Access Management (RAM) user must have the permissions to manage Simple Log Service.

You can attach the AliyunLogFullAccess system policy to a RAM user. After the RAM user is granted the permissions defined in the system policy, the RAM user can manage all Logstores. For more information, see Grant permissions to a RAM user.
You can also customize a policy to restrict the RAM user to only manage the audit logs of Tair (Redis OSS-compatible) instances.
Examples of custom policies
```
{
 "Version": "1",
 "Statement": [
  {
   "Action": "log:*",
   "Resource": "acs:log:*:*:project/nosql-*",
   "Effect": "Allow"
  }
 ]
}
```

Typical scenarios

Tair (Redis OSS-compatible) integrates specific features of Simple Log Service to provide the audit log feature that is stable, flexible, simple, and efficient. This feature can be used in the scenarios described in the following table.

Typical scenario	Description
Operation audit	The audit log feature helps security auditors discover information such as operator identity or data modification time, and identify internal risks such as abuse of permissions and execution of invalid commands.
Security compliance	The audit log feature assists business systems in meeting the audit requirements for security compliance.

Usage notes

After you enable the audit log feature for your instance, the system audits and logs the write operations that are performed on the instance. The instance may experience a performance decrease of 5% to 15% and some degree of latency and jitter. The performance decrease and the level of latency and jitter vary based on the amount of data that is written or audited.
Important
Your application may write large amounts of data to the instance. For example, your application frequently runs the INCR command to increment values. To prevent a performance decrease in such a scenario, we recommend that you enable the audit log feature only for troubleshooting or security audit purposes.
Typically, a large number of read operations are performed. If audit information is recorded for a large number of read operations, the instance performance may deteriorate. To prevent this issue, the system records audit information only for write operations.
When a command has a large number of parameters, the individual parameters are overly lengthy, or the total length of the command is excessively long, the command is not displayed in its entirety within the audit logs. The display format of the command is similar to that of the SLOWLOG command.

Billing

You are charged for the audit log feature based on the storage usage and log retention period. The price varies based on the region that you select. For more information, see Billable items.

Note

After the audit log feature is disabled, audit logs are still stored based on the previously configured log retention period until all logs expire. Therefore, you are still charged for audit logs after the feature is disabled.

Procedure

Log on to the console and go to the Instances page. In the top navigation bar, select the region in which the instance is deployed. Then, find the instance and click its ID.
In the left-side navigation pane, choose Logs > Audit Logs.
Specify a log retention period.
Note
This configuration is applicable to the instance and all instances that reside in the same region as the instance. Audit logs are billed based on the storage usage and retention period of logs. Valid values for the log retention period are 1 to 365. Unit: days.
Click Estimate Fees and Enable Audit Logs.
In the dialog box that appears, estimate log fees, read the prompt, and then click Enable.
Note
The audit log feature depends on Simple Log Service. If Simple Log Service is not activated for your Alibaba Cloud account, you are prompted to activate Simple Log Service.

Related API operations

API operation	Description
ModifyAuditLogConfig	Enables or disables the audit log feature and specifies a retention period for audit logs.
DescribeAuditLogConfig	Queries the audit log configurations of an instance. The configurations include whether the audit log feature is enabled and the retention period of audit logs.
DescribeAuditRecords	Queries the audit logs of an instance.

FAQ

How do I disable the audit log feature for an instance?
Log on to the console and go to the Audit Logs page of the instance. In the upper-right corner of the page, click Service Settings. Then, you can disable the audit log feature.
How do I download all audit logs?
You can use multiple methods to download audit logs. For more information, see Download logs. When you download all audit logs, take note of the following items:
- You must specify the redis_audit_log_standard Logstore and specify the project name in the following format: nosql-{ID of your Alibaba Cloud account}-{Region}. Example: nosql-176498472******-cn-hangzhou.
- You must select Download with Cloud Shell or Download with CLI. If you select Download, you can download only the audit logs that are displayed on the current page.
Why does the audit log feature support write operations but not read operations?
In most scenarios, the number of read operations is larger than the number of write operations. The auditing for read operations can cause serious performance degradation. In addition, a large number of audit logs need to be generated and stored for read operations. As a consequence, the system may discard specific audit logs to ensure service stability. Due to these issues, the audit log feature does not support read operations.
If I specify different log retention periods for two instances in the same region that have the audit log feature enabled, which log retention period is applied to all the instances in the region?
The last log retention period that you specify is applied.
Why do I find that the client IP addresses recorded in specific audit logs are not the same as the IP address of the client on which my application runs?
The audit logs record write operations on the database system. You can filter out this type of information.
Why am I unable to enable the audit log feature for an instance that runs Redis 4.0 or later?
The minor version of the instance needs to be updated. For information about how to update the minor version of an instance, see Update the minor version of an instance.