apache / apache/doris

[Feature] Identifying user session in audit logs

Open
#49,915 2 comments 0 reactions 0 assignees View on GitHub
kind/feature
Dominant language
Java
Stars
15.9k
Forks
3.9k
Avg merge
2d 23h
Merged PRs (30d)
520

Description

### Search before asking

- [x] I had searched in the [issues](https://github.com/apache/doris/issues?q=is%3Aissue) and found no similar issues.

### Description

Currently audit log contains information like client IP, user name, statement, status and so on. But it is unknown if a set of queries are a part of some specific session/connection, or are executed independently.

Other databases like Postgres allow to track each session specifically:
* There is a [pg_stat_activity](https://www.postgresql.org/docs/current/monitoring-stats.html#MONITORING-PG-STAT-ACTIVITY-VIEW) view which returns state of currently executed sessions in the system.
* Sessions have a name which is set using [ApplicationName](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNECT-APPLICATION-NAME) client parameter. So session can be tracked by explicit name given by a user, and not by some random ID (which user doesn't know or log on client side in most cases).
* Audit extensions (e.g. pg_proaudit) include [session identifier column](https://postgrespro.ru/docs/postgrespro/14/pg-proaudit?lang=en#PG-PROAUDIT-VIEWING-SECURITY-EVENT-LOG)

Finally, the combination of session_id + timestamp + query_id can tell everything which was done by specific session, and in which order.

But currently I don't see how this can be implemented in Doris:
* There is no session/application/connection state concept. I don't see any views which can return this information.
* There is no client/protocol option which accepts user-specified session/connection name, and saves it into some database object/view which can be used for introspection or audit.
* There is no sessionId/connectionId column in audit event, so queries cannot be grouped by connection, they all seems to be totally independent.

Please consider implementing:
* system view or table with list of currently opened connections/sessions
* connection/session name can be explicitly set by user
* audit logs should contain connection/session id and name

### Use case

Inspection of audit logs can give information about specific user and query which was executed by Doris. But it don't give any information about application or script which executed this query, so this becomes hard to track down falling query source.

This feature may allow implementing [OpenLineage](https://openlineage.io/) integration in future, based on audit logs info. In this case, session name is used as `Job.name`, to group executed queries together.

### Related issues

_No response_

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.