为了更快的定位您的问题,请提供以下信息,谢谢
【详述】sr版本从3.2.8升级到3.2.16后审计日志插件采集不到审计日志到表里,
审计日志插件的版本为:
version=3.0.2
java.version=1.8.0
审计日志plugin.conf配置文件如下:
### plugin configuration
# The max size of a batch, default is 50MB
max_batch_size=52428800
# The max interval of batch loaded, default is 60 seconds
max_batch_interval_sec=60
# the max stmt length to be loaded in audit table, default is 1048576
max_stmt_length=1048576
# StarRocks FE host for loading the audit, default is 127.0.0.1:8030.
# this should be the host port for stream load
frontend_host_port=127.0.0.1:8030
# If the response time of a query exceed this threshold, it will be recored in audit table as slow_query.
qe_slow_log_ms=5000
# the capacity of audit queue, default is 1000
max_queue_size=1000
# Database of the audit table
database=starrocks_audit_db__
# Audit table name, to save the audit data.
table=starrocks_audit_tbl__
# StarRocks user. This user must have LOAD_PRIV to the audit table.
user=root
# StarRocks user’s password
password=xxxx
fe.log审计日志相关报错信息如下:**
** 2026-01-23 09:58:27.023+08:00 WARN (audit loader thread|252598) [StarrocksStreamLoader.loadBatch():156] failed to load audit via AuditLoader plugin with label: audit_20260123_095827_10_168_89_25_9010**
java.lang.Exception: status is not TEMPORARY_REDIRECT 307, status: 400, response: Bad Request.
Validation failed for header ‘column_separator’, request is: curl -v -X PUT *
** -H “Authorization”:“Basic cm9vdDo1NERiYUJ5aCNfIw==” *
** -H “Expect”:“100-continue” **
–
** -H “columns”:“queryId, timestamp, queryType, clientIp, user, authorizedUser, resourceGroup, catalog, db, state, errorCode,queryTime, scanBytes, scanRows, returnRows, cpuCostNs, memCostBytes, stmtId, isQuery, feIp, stmt, digest, planCpuCosts, planMemCosts” **
** "http://127.0.0.1:8030/api/starrocks_audit_db__/starrocks_audit_tbl__/_stream_load?"**
** at com.starrocks.plugin.audit.StarrocksStreamLoader.loadBatch(StarrocksStreamLoader.java:130) ~[?:?]**
** at com.starrocks.plugin.audit.AuditLoaderPlugin.loadIfNecessary(AuditLoaderPlugin.java:222) ~[?:?]**
** at com.starrocks.plugin.audit.AuditLoaderPlugin.access$300(AuditLoaderPlugin.java:46) ~[?:?]**
** at com.starrocks.plugin.audit.AuditLoaderPlugin$LoadWorker.run(AuditLoaderPlugin.java:310) ~[?:?]**
** at java.lang.Thread.run(Thread.java:834) ~[?:?]**
按官方文档将审计日志插件升级到5.0版本后,fe.log无报错,但是审计日志依然未采集到表里
### plugin configuration
# The max size of a batch, default is 50MB
max_batch_size=52428800
# The max interval of batch loaded, default is 60 seconds
max_batch_interval_sec=60
# the max stmt length to be loaded in audit table, default is 1048576
max_stmt_length=1048576
# StarRocks FE host for loading the audit, default is 127.0.0.1:8030
# this should be the host port for stream load
frontend_host_port=127.0.0.1:8030
# If the response time of a query exceed this threshold, it will be recored in audit table as slow_query
qe_slow_log_ms=5000
# the capacity of audit queue, default is 1000
max_queue_size=1000
# Database of the audit table
database=starrocks_audit_db__
# Audit table name, to save the audit data
table=starrocks_audit_tbl__
# StarRocks user. This user must have import permissions for the audit table
user=root
# StarRocks user’s password
password=xxxx
# StarRocks password encryption key
secret_key=
# Filter conditions when importing audit information
filter=
# Timeout for uninstalling the plugin, default is 5000 ms
uninstall_timeout=5000
starrocks_audit_tbl__建表语句.txt (17.6 KB)
【业务影响】
【是否存算分离】否
【StarRocks版本】3.2.8->3.2.16
【集群规模】3fe(3 follower)+12be(fe与be混合部署)
【机器信息】65C/750G/万兆
【联系方式】 StarRocks社区群5 -思变 [1412195108@qq.com]
【附件】