[IMPALA-8768] Clarifying the conditions in which audit logs record a query

• Type: Task
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: Impala 2.13.0, Impala 3.3.0
• Fix Version/s: Impala 3.4.0
• Component/s: Docs
• Epic Color: ghx-label-3
• Assignee: Alexandra Rodoni
• Reporter: Vincent Tran
• Created: 17/Jul/19 18:04
• Updated: 01/Nov/19 20:53
• Resolved: 31/Oct/19 23:05

Description

Currently, Impala documentation highlights the following cases as operations which the audit logs will record:

Which Operations Are Audited
The kinds of SQL queries represented in the audit log are:

Queries that are prevented due to lack of authorization.
Queries that Impala can analyze and parse to determine that they are authorized. The audit data is recorded immediately after Impala finishes its analysis, before the query is actually executed.
The audit log does not contain entries for queries that could not be parsed and analyzed. For example, a query that fails due to a syntax error is not recorded in the audit log. The audit log also does not contain queries that fail due to a reference to a table that does not exist, if you would be authorized to access the table if it did exist.

Certain statements in the impala-shell interpreter, such as CONNECT, SUMMARY, PROFILE, SET, and QUIT, do not correspond to actual SQL queries, and these statements are not reflected in the audit log.

However, based on[1], there is an unmentioned condition that the client must have issued at least one fetch for analyzed queries to be recorded in audit logs.

[1] https://github.com/apache/impala/blob/b3b00da1a1c7b98e84debe11c10258c4a0dff944/be/src/service/impala-server.cc#L690-L734