ScyllaDB Auditing Guide¶

audit_categories parameter description¶

For details on auditing Alternator operations, see Auditing Alternator Requests.

Note that enabling audit may negatively impact performance and audit-to-table may consume extra storage. That’s especially true when auditing DML and QUERY categories, which generate a high volume of audit messages.

Auditing Alternator Requests¶

When auditing is enabled, Alternator (DynamoDB-compatible API) requests are audited using the same backends and the same filtering configuration (audit_categories, audit_keyspaces, audit_tables) as CQL operations. No additional configuration is needed.

Both successful and failed Alternator requests are audited.

<OperationName>|<JSON request body>

PutItem|{"TableName":"my_table","Item":{"p":{"S":"pk_val"},"c":{"S":"ck_val"},"v":{"S":"data"}}}

# Using audit_tables - use 'alternator' as the keyspace name:
audit_tables: "alternator.my_table_name"

# Using audit_keyspaces - use the real keyspace name:
audit_keyspaces: "alternator_my_table_name"

Mar 18 10:15:03 ip-10-143-2-108 scylla-audit[28387]: node="10.143.2.108", category="DML", cl="LOCAL_QUORUM", error="false", keyspace="alternator_my_table", query="PutItem|{\"TableName\":\"my_table\",\"Item\":{\"p\":{\"S\":\"pk_val\"}}}", client_ip="127.0.0.1", table="my_table", username="anonymous"

SELECT * FROM audit.audit_log ;

 date                    | node         | event_time                           | category | consistency  | error | keyspace_name         | operation                                                                        | source    | table_name | username  |
-------------------------+--------------+--------------------------------------+----------+--------------+-------+-----------------------+----------------------------------------------------------------------------------+-----------+------------+-----------+
2026-03-18 00:00:00+0000 | 10.143.2.108 | 3429b1a5-2a94-11e8-8f4e-000000000001 |      DML | LOCAL_QUORUM | False | alternator_my_table   | PutItem|{"TableName":"my_table","Item":{"p":{"S":"pk_val"}}}                     | 127.0.0.1 |   my_table | anonymous |
(1 row)

Storing Audit Messages in Syslog¶

Procedure

1. Set the audit parameter in the scylla.yaml file to syslog.

   For example:

   # audit setting
   # 'audit' config option controls if and where to output audited events:
   audit: "syslog"
   #
   # List of statement categories that should be audited.
   audit_categories: "DCL,DDL,AUTH"
   #
   # List of tables that should be audited.
   audit_tables: "mykespace.mytable"
   #
   # List of keyspaces that should be fully audited.
   # All tables in those keyspaces will be audited
   audit_keyspaces: "mykespace"
   

2. Restart the ScyllaDB node.

sudo systemctl restart scylla-server

docker exec -it some-scylla supervisorctl restart scylla

By default, audit messages are written to the same destination as ScyllaDB logging, with scylla-audit as the process name.

Logging output example (CQL drop table):

Mar 18 09:53:52 ip-10-143-2-108 scylla-audit[28387]: node="10.143.2.108", category="DDL", cl="ONE", error="false", keyspace="nba", query="DROP TABLE nba.team_roster ;", client_ip="127.0.0.1", table="team_roster", username="anonymous"

To redirect the Syslog output to a file, follow the steps below (available only for CentOS) :

1. Install rsyslog sudo dnf install rsyslog.

2. Edit /etc/rsyslog.conf and append the following to the file: if $programname contains 'scylla-audit' then /var/log/scylla-audit.log.

3. Start rsyslog systemctl start rsyslog.

4. Enable rsyslog systemctl enable rsyslog.

Storing Audit Messages in a Table¶

Messages are stored in a ScyllaDB table named audit.audit_log.

For example:

CREATE TABLE IF NOT EXISTS audit.audit_log (
      date timestamp,
      node inet,
      event_time timeuuid,
      category text,
      consistency text,
      table_name text,
      keyspace_name text,
      operation text,
      source inet,
      username text,
      error boolean,
      PRIMARY KEY ((date, node), event_time));

Procedure

1. Set the audit parameter in the scylla.yaml file to table.

   For example:

   # audit setting
   # 'audit' config option controls if and where to output audited events:
   audit: "table"
   #
   # List of statement categories that should be audited.
   audit_categories: "DCL,DDL,AUTH"
   #
   # List of tables that should be audited.
   audit_tables: "mykespace.mytable"
   #
   # List of keyspaces that should be fully audited.
   # All tables in those keyspaces will be audited
   audit_keyspaces: "mykespace"
   

2. Restart the ScyllaDB node.

   Supported OSDocker

   sudo systemctl restart scylla-server
   

   Table output example (CQL drop table):

   SELECT * FROM audit.audit_log ;
   

   returns:

    date                    | node         | event_time                           | category | consistency | error | keyspace_name | operation                    | source          | table_name  | username |
   -------------------------+--------------+--------------------------------------+----------+-------------+-------+---------------+------------------------------+-----------------+-------------+----------+
   2018-03-18 00:00:00+0000 | 10.143.2.108 | 3429b1a5-2a94-11e8-8f4e-000000000001 |      DDL |         ONE | False |           nba | DROP TABLE nba.team_roster ; | 127.0.0.1       | team_roster | Scylla   |
   (1 row)
   

Storing Audit Messages in a Table and Syslog Simultaneously¶

Procedure

1. Follow both procedures from above, and set the audit parameter in the scylla.yaml file to both syslog and table. You need to restart ScyllaDB only once.

   To have both syslog and table you need to specify both backends separated by a comma:

   audit: "syslog,table"