Add table for Gateway audit logs by kjsbot · Pull Request #816 · trinodb/trino-gateway

kjsbot · 2026-01-02T01:58:02Z

Description

Adds support for a audit logs table for all 3 databases.

Additional context and related issues

Following up on the discussion for issue #803, this PR adds new tables for auditing logs, it also creates supporting classes for updating the tables. Comments will be collected via the UI and from the body of curl requests (separate PR). Open to any further discussion or questions!

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
(x) Release notes are required, with the following suggested text:

* Add new table for audit logs.

kbhatianr · 2026-01-05T19:20:18Z

gateway-ha/src/main/java/io/trino/gateway/ha/AuditLogger.java

+
+import static java.util.Objects.requireNonNull;
+
+public class AuditLogger


I would make AuditLogger an interface, and then add different types of AuditLoggers. e.g, a DatabaseAuditLogger for writing it to to the DB, and/or a LogAuditLogger that simply emits it out to log.info()

Chaho12 · 2026-01-21T14:11:05Z

gateway-ha/src/main/resources/mysql/V1__create_schema.sql

+    user_name VARCHAR(256) NOT NULL,
+    ip_address VARCHAR(45),
+    backend_name VARCHAR(256) NOT NULL,
+    operation VARCHAR(256) NOT NULL,


256 seems to be too long. isn't this one of AuditActions?
64 seems to be sufficient

Chaho12 · 2026-01-21T14:11:34Z

gateway-ha/src/main/resources/mysql/V1__create_schema.sql

+    ip_address VARCHAR(45),
+    backend_name VARCHAR(256) NOT NULL,
+    operation VARCHAR(256) NOT NULL,
+    context VARCHAR(256) NOT NULL,


I am not sure what you intent by context, but it seems to be quite small. Why not text?

Context refers to where the admin made the change - ex: curl-ing, webapp, etc

Chaho12 · 2026-01-21T14:12:16Z

gateway-ha/src/main/resources/mysql/V1__create_schema.sql

+    context VARCHAR(256) NOT NULL,
+    success BOOLEAN NOT NULL,
+    user_comment VARCHAR(1024),
+    change_time TIMESTAMP NOT NULL,


Audit log should have default timestamp, no?

Chaho12 · 2026-01-21T14:13:37Z

gateway-ha/src/main/resources/postgresql/V1__create_schema.sql

 );
+
+CREATE TABLE IF NOT EXISTS gateway_audit_logs (
+    audit_id BIGSERIAL,


Suggested change

audit_id BIGSERIAL,

audit_id BIGSERIAL PRIMARY KEY,

not so sure, but can you do this instead of line 91?

Chaho12 · 2026-01-21T14:13:52Z

gateway-ha/src/main/resources/postgresql/V1__create_schema.sql

+    ip_address VARCHAR(45),
+    backend_name VARCHAR(256) NOT NULL,
+    operation VARCHAR(256) NOT NULL,
+    context VARCHAR(256) NOT NULL,


In my opinion, I think having different columns can make management simpler as well as being better for querying

Chaho12 · 2026-01-21T14:14:36Z

gateway-ha/src/main/resources/postgresql/V1__create_schema.sql

+    backend_name VARCHAR(256) NOT NULL,
+    operation VARCHAR(256) NOT NULL,
+    context VARCHAR(256) NOT NULL,
+    success SMALLINT NOT NULL CHECK (success IN (0, 1)),


why not BOOLEAN?

Chaho12 · 2026-01-21T14:15:27Z

gateway-ha/src/main/resources/postgresql/V1__create_schema.sql

+    operation VARCHAR(256) NOT NULL,
+    context VARCHAR(256) NOT NULL,
+    success SMALLINT NOT NULL CHECK (success IN (0, 1)),
+    user_comment VARCHAR(1024),


How about text?

Ideally comments will be kept sort and brief which is why the 1024 limit is kept, anything going over should be truncated

Chaho12 · 2026-01-21T14:16:05Z

gateway-ha/src/main/resources/oracle/V1__create_schema.sql

+    ip_address VARCHAR2(45),
+    backend_name VARCHAR(256) NOT NULL,
+    operation VARCHAR(256) NOT NULL,
+    context VARCHAR(256) NOT NULL,


Maybe CLOB?

Chaho12 · 2026-01-21T14:16:42Z

gateway-ha/src/main/resources/postgresql/V1__create_schema.sql

+    context VARCHAR(256) NOT NULL,
+    success SMALLINT NOT NULL CHECK (success IN (0, 1)),
+    user_comment VARCHAR(1024),
+    change_time TIMESTAMP NOT NULL,


How about TIMESTAMPTZ NOT NULL DEFAULT now()?

Chaho12 · 2026-01-21T14:17:06Z

gateway-ha/src/main/resources/oracle/V1__create_schema.sql

+    context VARCHAR(256) NOT NULL,
+    success NUMBER(1) NOT NULL CHECK (success IN (0,1)),
+    user_comment VARCHAR(1024),
+    change_time TIMESTAMP NOT NULL,


How about

TIMESTAMP WITH TIME ZONE CURRENT_TIMESTAMP NOT NULL

Chaho12 · 2026-01-21T14:17:30Z

gateway-ha/src/main/resources/oracle/V1__create_schema.sql

 );
+
+CREATE TABLE gateway_audit_logs (
+    audit_id NUMBER GENERATED ALWAYS as IDENTITY(START with 1 INCREMENT by 1),


Suggested change

audit_id NUMBER GENERATED ALWAYS as IDENTITY(START with 1 INCREMENT by 1),

audit_id NUMBER(19) GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,

Chaho12 · 2026-02-04T14:03:48Z

Can you rebase and resolve conflicts?

# Conflicts: # gateway-ha/src/main/resources/gateway-ha-persistence-mysql.sql

oneonestar · 2026-02-13T05:54:15Z

gateway-ha/src/main/java/io/trino/gateway/ha/audit/AuditLogger.java

+        String c = requireNonNullElse(comment, "");
+        return c.replaceAll("\\s+", " ").trim();
+    }
+}


I don’t like the design where CompositeAuditLogger implements AuditLogger.

There are a few problems with this design:

It mixes normal binding and multibindings on the same interface (AuditLogger), which makes the configuration hard to understand:

binder().bind(AuditLogger.class).to(CompositeAuditLogger.class).in(Scopes.SINGLETON); Multibinder<AuditLogger> auditLoggers = newSetBinder(binder(), AuditLogger.class); auditLoggers.addBinding().to(DatabaseAuditLogger.class).in(Scopes.SINGLETON); auditLoggers.addBinding().to(LogAuditLogger.class).in(Scopes.SINGLETON);

It mixes implementation details with the interface (e.g., static String sanitizeComment).

The roles of CompositeAuditLogger and the other loggers are different, so they should not be combined under the same interface.

I would recommend using the following approach instead:

https://github.com/trinodb/trino/blob/355a131042a7ff049718b46b5bf8cedc0c7d215d/core/trino-main/src/main/java/io/trino/sql/rewrite/StatementRewrite.java

https://github.com/trinodb/trino/blob/355a131042a7ff049718b46b5bf8cedc0c7d215d/core/trino-main/src/main/java/io/trino/server/CoordinatorModule.java#L344-L350

cla-bot bot added the cla-signed label Jan 2, 2026

kbhatianr reviewed Jan 5, 2026

View reviewed changes

kjsbot requested review from kbhatianr, mosabua and prakhar10 January 5, 2026 21:44

kjsbot changed the title ~~[DRAFT WIP]Add table for Gateway audit logs~~ Add table for Gateway audit logs Jan 6, 2026

kjsbot marked this pull request as ready for review January 6, 2026 21:47

Chaho12 reviewed Jan 21, 2026

View reviewed changes

kjsbot added 12 commits February 4, 2026 10:46

Add gateway_audit_logs table to DB schema

f86f7e3

# Conflicts: # gateway-ha/src/main/resources/gateway-ha-persistence-mysql.sql

Update postgres table

7929e66

Remove DB field

1b2eb36

Add helpers for writing to DB

3e31ffd

Update DB schema

f2d9c20

Remove line

c2622b1

Update test case

b39a335

Update test case

3b0f520

Make AuditLogger interface, update docs

7471e34

Update table columns

0604aea

Add comment fields to UI for auditing

2e071e6

Resolve merge conflicts

d7c9058

kjsbot force-pushed the feature/audit-table branch from 71f5cfd to d7c9058 Compare February 4, 2026 19:43

Merge branch 'main' into feature/audit-table

ffeace6

oneonestar reviewed Feb 13, 2026

View reviewed changes

oneonestar linked an issue Feb 13, 2026 that may be closed by this pull request

Add New Table for Audit Logs #803

Open

kjsbot added 2 commits February 13, 2026 10:35

Update AuditLogger design

4366e8f

Add test

9e465fb


		import static java.util.Objects.requireNonNull;

		public class AuditLogger

	audit_id NUMBER GENERATED ALWAYS as IDENTITY(START with 1 INCREMENT by 1),
	audit_id NUMBER(19) GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,

Conversation

kjsbot commented Jan 2, 2026

Description

Additional context and related issues

Release notes

Uh oh!

kbhatianr Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kjsbot Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kjsbot Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Chaho12 commented Feb 4, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Comments

kbhatianr Jan 5, 2026 •

edited

Loading

kjsbot Jan 21, 2026 •

edited

Loading

kjsbot Jan 21, 2026 •

edited

Loading