Ensure Centralized Audit Log Collection Is Configured

Trung bìnhCấp 1Xem xét thủ côngtdsql

Mô tả

TDSQL can use managed Filebeat instances to collect logs from compute nodes, data nodes, and Agents and send them to Kafka or Elasticsearch. The destination may be DBbrain full-link audit analysis or an equivalent enterprise SIEM. Central collection must cover all production instances and all security-relevant log sources.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Verify the Filebeat process and management-platform configuration on every production instance: ps aux | grep '[f]ilebeat' # Inspect the effective Filebeat inputs and outputs. grep -E 'type:|paths:|output\.kafka|output\.elasticsearch|hosts:|topic:' \ /path/to/filebeat.yml Confirm that the following required sources are enabled where present: 1. Compute-node interface logs. 2. Compute-node SQL logs. 3. Data-node DB audit logs. 4. Data-node slow query logs. 5. Data-node error logs. 6. Agent sys_log, back_log, and dump_log. 7.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

In the TDSQL management platform, open the instance's Filebeat audit-log settings and enable the required compute-node, data-node, and Agent log inputs. Configure an approved Kafka or Elasticsearch destination and use consistent topics and partition rules for equivalent logs across instances. Where DBbrain high-level analysis is licensed, Kafka output may be connected to DBbrain for full-link analysis. DBbrain is optional;

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: tdsqlloggingaudit
Tham chiếu: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 6.8 Ensure Centralized Audit Log Collection Is Configured