TiDB Audit Plugin User Guide August 4, 2022 TiDB Audit Plugin User Guide Introduction The TiDB audit plugin records the TiDB server’s activities that are expected to follow auditing regulations of of your organization. For each client session, the plugin records users accessing the server (that is, username and IP address), SQL queries executed, databases and tables accessed, environment variable package, and use the audit plugin. Download the plugin You can download the plugin on TiDB Enterprise Edition Downloads. Deploy the audit plugin After downloading the plugin, you can use either TiDB

this time period. • The default storage directory for plugins is changed from "" to /data/deploy/plugin. • The DM code is migrated to the folder “dm” in TiCDC code repository. Now DM follows TiDB in version transactions’ statements are not included in TIDB_TRX #28670 – Fix the wrong default value of the plugin_dir configuration #28084 – Fix the issue that the CONVERT_TZ function returns NULL when it is given Experimental Experimental Columnar storage (TiFlash) Y Y Y Y Y RocksDB engine Y Y Y Y Y Titan plugin Y Y Y Y Y Invisible indexes Y Y Y Y N Composite PRIMARY KEY Y Y Y Y Y Unique indexes Y Y Y Y Y

version. 2.2.1.1 System variables Variable name Change type Description default_authentication_plugin �→ Newly added Sets the au- thentication method that the server advertises. The default value is Experimental Experimental Experimental Columnar storage (TiFlash) Y Y Y Y RocksDB engine Y Y Y Y Titan plugin Y Y Y Y Invisible indexes Y Y Y N Composite PRIMARY KEY Y Y Y Y Unique indexes Y Y Y Y Clustered replication.enable-placement-rules: true replication.location-labels: ["host"] tiflash: logger.level: "info" pd_servers: - host: 10.0.1.1 tidb_servers: - host: 10.0.1.1 tikv_servers: - host: 10.0.1.1 port:

Experimental Experimental Experimental Columnar storage (TiFlash) Y Y Y Y RocksDB engine Y Y Y Y Titan plugin Y Y Y Y Invisible indexes Y Y Y N Composite PRIMARY KEY Y Y Y Y Unique indexes Y Y Y Y Clustered replication.enable-placement-rules: true replication.location-labels: ["host"] tiflash: logger.level: "info" pd_servers: - host: 10.0.1.1 tidb_servers: - host: 10.0.1.1 tikv_servers: - host: 10.0.1.1 port: to change it to noop. 3. Execute the following command to see the ID_SERIAL of the disk: udevadm info --name=/dev/sdb | grep ID_SERIAL E: ID_SERIAL=36d0946606d79f90025f3e09a0c1f9e81 E: ID_SERIAL_SHO

name, RU consumption, and time for waiting for resources. • In the system variable tidb_last_query_info, add a new entry ru_consumption to indicate the consumed RU by SQL statements. You can use this variable type Description TiFlash logger. �→ level �→ Modified Changes the default value from "debug" to "INFO" to reduce the cost of logging. TiDB Light- ning tidb.pd �→ - �→ addr Modified Configures the ad- Fix the issue that TiDB server might consume a significant amount of resources when the enterprise plugin for audit logging is used #49273 @lcwangchao • Fix the issue that the optimizer incorrectly converts

cluster-level tasks, and the task records persist after the restart. When tidb_analyze_version = 2, the Job_info column adds the analyze option infor- mation. • Damaged SST files in TiKV might cause the TiKV process Experimental Experimental Columnar storage (TiFlash) Y Y Y Y Y Y Y Y RocksDB engine Y Y Y Y Y Y Y Y Titan plugin Y Y Y Y Y Y Y Y Invisible indexes Y Y Y Y Y Y Y N 1TiDB incorrectly treats latin1 as a subset of replication.enable-placement-rules: true replication.location-labels: ["host"] tiflash: logger.level: "info" pd_servers: - host: 10.0.1.1 tidb_servers: - host: 10.0.1.1 tikv_servers: - host: 10.0.1.1 port:

accelerate queries in OLAP scenarios Y Y E N N N N N N N RocksDB engine Y Y Y Y Y Y Y Y Y Y Titan plugin Y Y Y Y Y Y Y Y Y Y Titan Level Merge E E E E E E E E E E Use buckets to improve scan concurrency replication.enable-placement-rules: true replication.location-labels: ["host"] tiflash: logger.level: "info" pd_servers: - host: 10.0.1.1 tidb_servers: - host: 10.0.1.1 tikv_servers: - host: 10.0.1.1 port: ${use_ssl}) db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{ Logger: logger.Default.LogMode(logger.Info), }) if err != nil { panic(err) 152 } return db } When using this function, you need to replace

enhancement. To use this feature, you can set the value of the PD configuration item security.redact-info-log to "marker". For more information, see documentation. 42 • Enhance TiKV log redaction #17206 enhancement. To use this feature, you can set the value of the TiKV configuration item security.redact-info-log to "marker". For more information, see documentation. 2.2.1.7 Data migration • TiCDC supports Description PD security �→ . �→ redact �→ - �→ info �→ -log Modified Support setting the value of the PD configu- ration item security �→ . �→ redact �→ - �→ info �→ -log to "marker �→ " to mark sensitive

queries in OLAP scenarios Y Y Y Y Y Y E N N N N N RocksDB engine Y Y Y Y Y Y Y Y Y Y Y Y Titan plugin Y Y Y Y Y Y Y Y Y Y Y Y Titan Level Merge E E E E E E E E E E E E Use buckets to improve scan concurrency replication.enable-placement-rules: true replication.location-labels: ["host"] tiflash: logger.level: "info" pd_servers: - host: 10.0.1.1 tidb_servers: - host: 10.0.1.1 tikv_servers: - host: 10.0.1.1 port: ${use_ssl}) 186 db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{ Logger: logger.Default.LogMode(logger.Info), }) if err != nil { panic(err) } return db } When using this function, you need to replace

queries in OLAP scenarios Y Y Y Y Y Y E N N N N N RocksDB engine Y Y Y Y Y Y Y Y Y Y Y Y Titan plugin Y Y Y Y Y Y Y Y Y Y Y Y Titan Level Merge E E E E E E E E E E E E Use buckets to improve scan concurrency replication.enable-placement-rules: true replication.location-labels: ["host"] tiflash: logger.level: "info" pd_servers: - host: 10.0.1.1 tidb_servers: - host: 10.0.1.1 tikv_servers: - host: 10.0.1.1 port: ${use_ssl}) 181 db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{ Logger: logger.Default.LogMode(logger.Info), }) if err != nil { panic(err) } return db } When using this function, you need to replace