【详述】3.0通过 Audit Loader 管理 StarRocks 中的审计日志无法安装插件，按照官网操作的
【背景】做过哪些操作？
1、（StarRocks v2.4.0 及其之后小版本的建表ddl）先创建CREATE DATABASE starrocks_audit_db__;
CREATE TABLE starrocks_audit_db__.starrocks_audit_tbl__ (
queryId VARCHAR(48) COMMENT “查询的唯一ID”,
timestamp DATETIME NOT NULL COMMENT “查询开始时间”,
clientIp VARCHAR(32) COMMENT “客户端IP”,
user VARCHAR(64) COMMENT “查询用户名”,
resourceGroup VARCHAR(64) COMMENT “资源组名”,
db VARCHAR(96) COMMENT “查询所在数据库”,
state VARCHAR(8) COMMENT “查询状态（EOF，ERR，OK）”,
errorCode VARCHAR(96) COMMENT “错误码”,
queryTime BIGINT COMMENT “查询执行时间（毫秒）”,
scanBytes BIGINT COMMENT “查询扫描的字节数”,
scanRows BIGINT COMMENT “查询扫描的记录行数”,
returnRows BIGINT COMMENT “查询返回的结果行数”,
cpuCostNs BIGINT COMMENT “查询CPU耗时（纳秒）”,
memCostBytes BIGINT COMMENT “查询消耗内存（字节）”,
stmtId INT COMMENT “SQL语句增量ID”,
isQuery TINYINT COMMENT “SQL是否为查询（1或0）”,
feIp VARCHAR(32) COMMENT “执行该语句的FE IP”,
stmt STRING COMMENT “原始SQL语句”,
digest VARCHAR(32) COMMENT “SQL指纹”,
planCpuCosts DOUBLE COMMENT “查询规划阶段CPU占用（纳秒）”,
planMemCosts DOUBLE COMMENT “查询规划阶段内存占用（字节）”
) ENGINE = OLAP
DUPLICATE KEY (queryId, timestamp, clientIp)
COMMENT “审计日志表”
PARTITION BY RANGE (timestamp) ()
DISTRIBUTED BY HASH (queryId) BUCKETS 3
PROPERTIES (
“dynamic_partition.time_unit” = “DAY”,
“dynamic_partition.start” = “-30”,
“dynamic_partition.end” = “3”,
“dynamic_partition.prefix” = “p”,
“dynamic_partition.buckets” = “3”,
“dynamic_partition.enable” = “true”,
“replication_num” = “3”
);
2、下载Audit Loader 安装包后unzip解压
3、 修改 plugin.conf 文件的frontend_host_port、user、password
4、重新打包以上文件zip -q -m -r auditloader.zip auditloader.jar plugin.conf plugin.properties
5、INSTALL PLUGIN FROM “<absolute_path_to_package>”;
【业务影响】
【StarRocks版本】3.0
【集群规模】例如：1fe+3be（fe与be混部）
【机器信息】CPU虚拟核/内存/网卡，例如：8C/24G/万兆
【联系方式】
【附件】
开始安装
