How to Audit ScyllaDB?

Introduction

In the era of big data and distributed systems, how to audit ScyllaDB has become a critical question for organizations aiming to ensure data security, compliance, and operational transparency. ScyllaDB, a high-performance NoSQL database compatible with Apache Cassandra, is widely used for its scalability and low-latency capabilities. However, as with any database handling sensitive information, auditing is essential to track user activities, monitor changes, and detect potential security breaches. This article explores the native auditing capabilities of ScyllaDB and how advanced tools like DataSunrise can enhance your auditing processes.

Native Database Audit in ScyllaDB

ScyllaDB provides built-in auditing features, particularly in its Enterprise Edition, which allow administrators to monitor and log database activities effectively. These native tools are configurable through the scylla.yaml file.

Configuring Native Auditing

audit: "table"
audit_categories: "DCL,DDL,AUTH,ADMIN"
audit_tables: "mykeyspace.mytable"
audit_keyspaces: "mykeyspace"

This configuration ensures that activities related to DCL, DDL, AUTH, and ADMIN are logged. The logs can be stored in a dedicated ScyllaDB table or sent to Syslog for further analysis.

Example Audit Table Structure

CREATE TABLE IF NOT EXISTS audit.audit_log (
    date timestamp,
    node inet,
    event_time timeuuid,
    category text,
    consistency text,
    table_name text,
    keyspace_name text,
    operation text,
    source inet,
    username text,
    error boolean,
    PRIMARY KEY ((date, node), event_time)
);

Example Audit Log Output

SELECT * FROM audit.audit_log;

 date                | node       | event_time                          | category | consistency | table_name | keyspace_name | operation | source     | username | error
---------------------+------------+-------------------------------------+----------+-------------+------------+---------------+-----------+------------+----------+-------
 2024-02-20 09:00:00 | 192.168.1.1| 123e4567-e89b-12d3-a456-426614174000 | DCL      | QUORUM      | mytable    | mykeyspace    | SELECT    | 192.168.1.2| admin    | false
 2024-02-20 09:05:00 | 192.168.1.1| 123e4567-e89b-12d3-a456-426614174001 | DDL      | QUORUM      | mytable    | mykeyspace    | CREATE    | 192.168.1.2| admin    | false
 2024-02-20 09:10:00 | 192.168.1.1| 123e4567-e89b-12d3-a456-426614174002 | AUTH     | QUORUM      | mytable    | mykeyspace    | LOGIN     | 192.168.1.3| user1    | false
 2024-02-20 09:15:00 | 192.168.1.1| 123e4567-e89b-12d3-a456-426614174003 | ADMIN    | QUORUM      | mytable    | mykeyspace    | ALTER     | 192.168.1.4| user2    | true

This output demonstrates how ScyllaDB captures operations such as SELECT, CREATE, LOGIN, and ALTER, along with metadata like IP, consistency, and error flags.

Database Audit with DataSunrise

While ScyllaDB’s native auditing tools are powerful, organizations with advanced security and compliance needs often require more comprehensive solutions. DataSunrise offers tools to enhance ScyllaDB auditing with real-time monitoring, audit trails, and automated compliance reporting.

Real-Time Monitoring and Query Analysis

DataSunrise monitors all database activity in real time, including privileged user actions, which are critical for detecting insider threats and unauthorized access.

Diagram showing DataSunrise’s real-time monitoring architecture, with a proxy server intercepting and logging database queries between users and ScyllaDB — DataSunrise real-time monitoring architecture for ScyllaDB, capturing and logging traffic via a secure proxy.

Advanced Audit Trails and Compliance Reporting

DataSunrise’s Data Activity History logs every operation and supports compliance with GDPR, HIPAA, and PCI DSS.

Screenshot of DataSunrise’s audit trail interface, showing a detailed log of database activities with filters for date, user, and operation type — DataSunrise audit trail interface with filters for user activity, date range, and command type in ScyllaDB.

Automated Alerts and Incident Response

DataSunrise supports automated alerting for suspicious behavior and policy violations, helping security teams act quickly in response to threats.

Conclusion

Auditing ScyllaDB is essential for data protection and regulatory compliance. While ScyllaDB’s native tools offer a solid foundation, DataSunrise provides advanced features such as real-time query logging, enriched audit trails, and automated reporting.

Download DataSunrise or schedule a demo to see how it enhances ScyllaDB security and compliance.