Log Shipping
Last updated: 2025-08-14 11:24:27
The database audit service of TencentDB for MySQL supports the log shipping feature. Database audit logs of TencentDB for MySQL instances can be collected and shipped to Cloud Log Service (CLS) for unified management and analysis or to TDMQ for CKafka (CKafka) for real-time stream computing. This document describes how to configure the log shipping feature for database audit in the console.
Prerequisites
Prerequisites for shipping logs to CLS:
Before using this feature, make sure you have activated CLS.
The instance is running.
Prerequisites for shipping logs to CKafka:
A routing policy has been added for CKafka instances.
The instance is running.
Supported Versions and Architectures
MySQL 5.6 20180101 and later versions.
MySQL 5.7 20190429 and later versions.
MySQL 8.0 20210330 and later versions.
The instance architecture is two-node, three-node, or Cluster Edition.
Log Shipping Billing
The feature of shipping TencentDB for MySQL database audit logs to CLS involves the third-party independently billed cloud service CLS. For billing details, see Cloud Log Service > Billing Overview.
The feature of shipping TencentDB for MySQL database audit logs to CKafka involves the third-party independently billed cloud service CKafka. For billing details, see TDMQ for CKafka > Billing Overview.
After the log shipping feature is enabled for database audit of TencentDB for MySQL, traffic fees will be incurred. The fees are charged based on the traffic of shipped logs. For details, see the table below.
Note:
After the log shipping feature is enabled, traffic fees are incurred. The system charges traffic fees incurred by this feature only once, regardless of whether logs are shipped to one destination (CLS or CKafka) or two destinations (CLS and CKafka).
Billing Item: Audit Log Traffic | |
Chinese Mainland (USD/GB) | Hong Kong (China) and Other Countries and Regions (USD/GB) |
0.05882353 | 0.08823529 |
Log Shipping Traffic Monitoring
After the log shipping feature is enabled, you can use the monitoring feature to learn about the real-time shipping traffic generated by log shipping.
Monitoring Metric Name | Callable Metric Name | Unit | Metric Description |
Shipping traffic | AuditDeliverRate | MB | Shipping traffic generated by the log shipping feature. |
You can find an instance with the log shipping feature enabled in the audit instance list, click the monitoring icon in the Log Shipping column, and view the shipping traffic monitoring data.
Log Shipping Status Display
As shown above, the audit log shipping status of instances is displayed in the Log Shipping column on the Database Audit page in the TencentDB for MySQL console. The descriptions of each shipping status are as follows.
CKafka: Indicate that you have enabled shipping database audit logs of an instance to CKafka.
CLS: Indicate that you have enabled shipping database audit logs of an instance to CLS.
Disabled: Indicate that you have not enabled shipping database audit logs of an instance.
Related Documentation
To configure shipping database audit logs to CLS and CKafka, see the steps in the following tabs.
Enabling Log Shipping to CLS
1. Log in to the TencentDB for MySQL console.
2. Click Database Audit in the left sidebar.
3. Select a region at the top, go to the Audit Instance page, click Audit Storage Status, and select the Enabled option to filter instances with database audit enabled.
4. Find the target instance in the audit instance list (or filter by resource attributes in the search box) and choose More > Configure Log Shipping in the Operation column.
5. (Skip this step if CLS has already been activated.) Click go to activate in the pop-up sidebar to activate CLS.
6. (Skip this step if CLS has already been activated.) Return to the console after activation and click Activation Completed in the pop-up window for activation confirmation.
Note:
During the activation process, the system will verify whether activation is successful. If the system prompts that activation has failed, wait for a while and try again.
7. (Skip this step if CLS has already been authorized.) Click Go to Authorize in the sidebar and click Grant in the Service Authorization pop-up window.
Note:
During the authorization process, the system will verify whether authorization is successful. If the system prompts that authorization has failed, wait for a while and try again.
8. Click Enable now in the Ship to CLS area in the sidebar.
9. Complete the following configurations in the pop-up window and click Enable now.
Parameter | Description |
Destination region | Select the region for log shipping. If CLS supports the region of the database instance, the instance region will be selected by default. You can also select other available regions. If CLS does not support the region of the database instance, you can select another region supported by CLS. |
Log topic operations | Available options: Select existing log topic and Create log topic. |
Select existing log topic | If you choose the Select existing log topic option, you need to select an existing logset and log topic. Logset: Logsets classify log topics to facilitate log topic management. You can filter existing logsets in the search box. Log topic: A log topic is the basic unit for collecting, storing, retrieving, and analyzing log data. You can filter log topics of the selected logset in the search box. Note： Log topics that can be selected in this step should be those created with the Create Log Topic option selected for log topic operations when enabling log shipping in the console. Log topics created in the CLS console cannot be selected. |
Create Log Topic | If you choose the Create log topic option, you need to create a log topic and add it to an existing logset or a newly created logset. Log topic: A log topic is the basic unit for collecting, storing, retrieving, and analyzing log data. You need to create a log topic. Select the existing logset: The log topic to be created will be added to an existing logset. If you select this option, you can filter existing logsets in the search box. Create logset: The log topic to be created will be added to a newly created logset. If you select this option, you need to create a logset. |
Viewing Information About Log Shipping to CLS
After the feature of shipping database audit logs to CLS is enabled for an instance, you can view the relevant information on log shipping to CLS (view the logset and log topic for log shipping).
1. Log in to the TencentDB for MySQL console.
2. Click Database Audit in the left sidebar.
3. Select a region at the top, find the target instance on the Audit Instance page (or filter by resource attributes in the search box), and choose More > Configure Log Shipping in the Operation column.
4. View the log shipping information in the pop-up sidebar.
5. Click the logset name, log topic name, or Search and Analysis button to view relevant log shipping information in the CLS console.
Disabling Log Shipping to CLS
Note:
After log shipping is disabled, database audit logs of an instance will no longer be shipped. Note: After log shipping is disabled, only the shipping of new logs is stopped. The existing logs are still stored in the log topics until they expire, and storage fees will continue to be incurred during this period. If you need to delete the log topics, go to Log Topic Management.
1. Log in to the TencentDB for MySQL console.
2. Click Database Audit in the left sidebar.
3. Select a region at the top, find the target instance on the Audit Instance page (or filter by resource attributes in the search box), and choose More > Configure Log Shipping in the Operation column.
4. Click Disable Shipping in the upper right corner of the Ship to CLS area in the pop-up sidebar.
5. Read the precautions in the pop-up window, select Disable, and click OK.
Enabling Log Shipping to CKafka
1. Log in to the TencentDB for MySQL console.
2. Click Database Audit in the left sidebar.
3. Select a region at the top, go to the Audit Instance page, click Audit Storage Status, and select the Enabled option to filter instances with database audit enabled.
4. Find the target instance in the audit instance list (or filter by resource attributes in the search box) and choose More > Configure Log Shipping in the Operation column.
5. (Skip this step if CKafka has already been activated.) Click go to activate in the pop-up sidebar to activate CKafka.
6. (Skip this step if CLS has already been activated.) Return to the console after activation and click Activation Completed in the pop-up window for activation confirmation.
Note:
During the activation process, the system will verify whether activation is successful. If the system prompts that activation has failed, wait for a while and try again.
7. (Skip this step if CLS has already been authorized.) Click Go to Authorize in the sidebar and click Grant in the Service Authorization pop-up window.
Note:
During the authorization process, the system will verify whether authorization is successful. If the system prompts that authorization has failed, wait for a while and try again.
8. Click Enable Immediately in the Ship to TDMQ for CKafka area in the pop-up sidebar.
9. Complete the following configurations in the pop-up window and click OK.
Parameter | Description |
Target Region | Select the region for log shipping. If CKafka supports the region of the database instance, the instance region will be selected by default. You can also select other available regions. If CKafka does not support the region of the database instance, you can select another region supported by CKafka. |
CKafka Instance | Select a CKafka instance in the target region. |
Topic | Select a topic for shipping. If no topic is available, you can create one. For operations, see Creating Topic. |
Viewing Information About Log Shipping to CKafka
After the feature of shipping database audit logs to CKafka is enabled for an instance, you can view the relevant information on log shipping to CKafka (view the CKafka instance ID, CKafka topic ID/name, region, and creation time for log shipping).
1. Log in to the TencentDB for MySQL console.
2. Click Database Audit in the left sidebar.
3. Select a region at the top, find the target instance on the Audit Instance page (or filter by resource attributes in the search box), and choose More > Configure Log Shipping in the Operation column.
4. View the log shipping information in the pop-up sidebar.
5. Click the CKafka instance ID, CKafka topic ID/name, and Message Query button to view instance details and query messages in the CKafka console.
Modifying Shipping Settings
After database audit log shipping to CKafka is enabled, you change the CKafka instance, region, or topic (CKafka topic ID/name) if needed. For details, see the steps below.
1. Log in to the TencentDB for MySQL console.
2. Click Database Audit in the left sidebar.
3. Select a region at the top, find the target instance on the Audit Instance page (or filter by resource attributes in the search box), and choose More > Configure Log Shipping in the Operation column.
4. Click Modify Shipping in the upper right corner of the Ship to TDMQ for CKafka area in the pop-up sidebar.
5. Select another CKafka instance, region, or topic (CKafka topic ID/name) in the pop-up window and click OK.
Disabling Log Shipping to CKafka
Note:
After log shipping is disabled, database audit logs of an instance will no longer be shipped. Note: After log shipping is disabled, only the shipping of new logs is stopped. The existing logs are still stored on CKafka until they expire, and storage fees will continue to be incurred during this period. If you need to delete messages, go to the CKafka console.
1. Log in to the TencentDB for MySQL console.
2. Click Database Audit in the left sidebar.
3. Select a region at the top, find the target instance on the Audit Instance page (or filter by resource attributes in the search box), and choose More > Configure Log Shipping in the Operation column.
4. Click Disable Shipping in the upper right corner of Ship to TDMQ for CKafka area in the pop-up sidebar.
5. Read the precautions in the pop-up window, select Disable, and click OK.
Appendix: Adding a Routing Policy
To ship database audit logs to TDMQ for CKafka (CKafka), you need to add a routing policy for the CKafka instance first. Otherwise, an error may occur during log shipping configuration, indicating that CKafka has no routing policy with the route type of Supporting Environment and the access mode of PLAINTEXT. Follow the steps below to add a routing policy.
1. Log in to the CKafka console.
2. Click Instance List in the left sidebar and click the ID/name of the target instance to go to the basic information page.
3. On the basic instance information page, click Add Routing Policy in the access mode module.
4. In the pop-up window, select Supporting Environment as the route type, select PLAINTEXT as the access method, and click Submit.
References
Relevant CLS documents:
Logset
Relevant CKafka documents:
Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No
Feedback