Important

Self-managed SingleStore will soon transition from version 9.1 RC to version 10. This new semantic versioning scheme will provide SingleStore with finer control over engine and feature releases that were not possible with the current versioning scheme.

In the interim, SingleStore 9.1 RC can be used to preview, evaluate, and provide feedback on the new and upcoming features in SingleStore 10 prior to its general availability. Ahead of this transition, SingleStore 9.0 is recommended for production workloads, which can later be upgraded to SingleStore 10.

Configure Audit Logging

To enable audit logging, configure audit log settings in the globalVariables section of your cluster custom resource (CR).

Add the audit log configuration to your sdb-cluster.yaml:

YAML

apiVersion: memsql.com/v1alpha1
kind: MemsqlCluster
metadata:
 name: sdb-cluster
spec:
 license: <license_key>
 adminHashedPassword: "<hashed_password>"

 globalVariables:
   auditlog_level: ADMIN-ONLY
   auditlog_disk_sync: OFF
   auditlog_rotation_size: 134217728
   auditlog_rotation_time: 3600

 nodeImage:
   repository: singlestore/node
   tag: alma-8.7.10-28804d3b1b

 redundancyLevel: 2

 aggregatorSpec:
   count: 2
   cores: 8
   memoryMB: 32768
   storageGB: 256

 leafSpec:
   count: 2
   cores: 8
   memoryMB: 32768
   storageGB: 512

Apply the configuration:

YAML

kubectl apply -f sdb-cluster.yaml

You can configure the following audit log variables:

Variable	Description	Default	Example
`auditlog_level`	Audit logging level. Refer to Audit Logging Levels for more information.	`OFF`	`ADMIN-ONLY`, `WRITES-ONLY`, `ALL`
`auditlog_disk_sync`	Sync to disk after each write	`ON`	`OFF`
`auditlog_retention_period`	Retention period (in days) for audit log files. A value of `0` retains log files on the server indefinitely.	`0`	`7`, `30`, `90`
`auditlog_rotation_size`	Maximum log file size in bytes	`134217728`	`268435456`
`auditlog_rotation_time`	Maximum time in seconds before rotation	`3600`	`7200`

SQL

SHOW GLOBAL VARIABLES LIKE 'audit%';

Connect to your cluster and verify the settings:

You can collect audit logs from your Kubernetes cluster using a Kubernetes Job.

To automate report collection and upload to your storage backend, create a Kubernetes Job. This approach works with on-premises storage (NFS, local persistent volumes) and object storage systems (MinIO, S3-compatible storage).

Create storage credentials secret (one-time setup)

For S3-compatible storage:
Shell
```
kubectl create secret generic aws-credentials \
 --from-literal=access-key-id=YOUR_ACCESS_KEY \
 --from-literal=secret-access-key=YOUR_SECRET_KEY
```
For other storage backends, create appropriate secrets for your authentication method.

Create cluster-collection-job.yaml

YAML

apiVersion: batch/v1
kind: Job
metadata:
  name: singlestore-report-collection
spec:
  template:
    spec:
      serviceAccountName: tools
      containers:
      - name: report-collector
        image: singlestore/tools:latest
        command: ["/bin/bash", "-c"]
        args:
        - |
          # Collect the cluster report
          sdb-report collect-kube --cluster-name sdb-cluster --namespace default --output-path /tmp/report
          REPORT_FILE=$(ls -t /tmp/report/*.tar.gz | head -1)

          # Upload to S3-compatible object storage (e.g., MinIO)
          aws s3 cp $REPORT_FILE s3://${BUCKET_NAME}/cluster-reports/ --endpoint-url ${S3_ENDPOINT}

          # On-premises storage options:
          # - NFS: cp $REPORT_FILE /mnt/nfs/cluster-reports/
          # - Local PV: cp $REPORT_FILE /mnt/storage/cluster-reports/

        env:
        # S3-compatible storage configuration (e.g., MinIO)
        - name: AWS_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
              name: storage-credentials
              key: access-key-id
        - name: AWS_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: storage-credentials
              key: secret-access-key
        - name: BUCKET_NAME
          value: "your-bucket-name"
        - name: S3_ENDPOINT
          value: "http://minio:9000"

        # Optional: mount on-premises storage
        # volumeMounts:
        # - name: nfs-storage
        #   mountPath: /mnt/nfs
        # - name: local-storage
        #   mountPath: /mnt/storage

      restartPolicy: Never

      # Optional: define on-premises volumes
      # volumes:
      # - name: nfs-storage
      #   nfs:
      #     server: your-nfs-server
      #     path: /path/to/storage
      # - name: local-storage
      #   hostPath:
      #     path: /path/to/local/storage
      #     type: Directory

  backoffLimit: 3

Run the job

Shell

kubectl apply -f cluster-collection-job.yaml

Check progress and view logs

Shell

# Check job status
kubectl get jobs

# View logs
kubectl logs job/singlestore-report-collection

# Verify upload to external storage

# For S3-compatible object storage (for example, MinIO):
aws s3 ls s3://<your-bucket>/cluster-reports/ --endpoint-url <your-endpoint>

# For NFS or local persistent storage (from a mounted node or pod):
ls /mnt/nfs/cluster-reports/

Clean up (optional)

Shell

kubectl delete job singlestore-report-collection

Note

Ensure the tools service account has the required RBAC permissions. Refer to Create and Apply the Tools RBAC for more information.

Configure Audit Logging

Was this article helpful?

Was this article helpful?