启用审计 / 日志记录

Oracle

-- Unified Auditing (12c+):
CREATE AUDIT POLICY table_audit
  ACTIONS SELECT, INSERT, UPDATE, DELETE ON hr.employees;
AUDIT POLICY table_audit;
-- Monitoring: SELECT * FROM unified_audit_trail ORDER BY event_timestamp DESC;

使用 Unified Auditing 时，创建策略并用 AUDIT 启用；记录保存在 unified_audit_trail 视图中。

PostgreSQL

-- pgaudit extension (recommended; first shared_preload_libraries = 'pgaudit' + restart + CREATE EXTENSION pgaudit):
ALTER SYSTEM SET pgaudit.log = 'write, ddl';
SELECT pg_reload_conf();
-- Simple built-in method:
ALTER SYSTEM SET log_statement = 'ddl';
SELECT pg_reload_conf();

pgaudit 提供详细的审计日志；使用 ALTER SYSTEM 设置以在整个服务器范围生效（会话级 SET 只审计该会话）。没有该扩展时，可通过 log_statement（'ddl','mod','all'）启用基本日志记录。注意日志量。

MySQL

-- Enterprise/MariaDB audit plugin:
INSTALL PLUGIN audit_log SONAME 'audit_log.so';
SET GLOBAL audit_log_policy = 'ALL';
-- Simple alternative (all queries):
SET GLOBAL general_log = 'ON';

audit_log 插件（Enterprise，MariaDB 中为 server_audit）保留详细的审计记录；general_log 记录所有查询，但会降低性能。

SQL Server

USE master;
CREATE SERVER AUDIT Audit_A TO FILE (FILEPATH = 'C:\\audit\\');
ALTER SERVER AUDIT Audit_A WITH (STATE = ON);
USE mydb;
CREATE DATABASE AUDIT SPECIFICATION db_spec
  FOR SERVER AUDIT Audit_A
  ADD (SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo BY public)
  WITH (STATE = ON);

先创建并启用 SERVER AUDIT 目标（文件/事件日志），然后通过服务器级或数据库级 AUDIT SPECIFICATION 定义要跟踪的事件。

MongoDB

# MongoDB Enterprise / Atlas only. Configuration (mongod.conf):
#   auditLog:
#     destination: file
#     format: JSON
#     path: /var/log/mongodb/audit.json
#     filter: '{ atype: { $in: ["authCheck","createCollection","dropCollection"] } }'
# mongod --auditDestination file --auditPath /var/log/mongodb/audit.json

审计仅在 Enterprise 和 Atlas 中可用；通过 mongod 配置的 auditLog 部分启用。Community 版中不提供。

Redis

ACL LOG
# Shows rejected authentication/command/key access attempts.
# To reset: ACL LOG RESET
# For general command auditing: an external proxy or MONITOR (with care).

ACL LOG 会自动记录安全事件（认证失败、未授权的命令/键）；没有内置的完整命令审计。

Elasticsearch

# elasticsearch.yml (on all nodes, restart required):
xpack.security.audit.enabled: true
# Optional event filter:
xpack.security.audit.logfile.events.include: [ "authentication_failed", "access_denied" ]

审计日志通过 xpack.security.audit.enabled 启用；在 elasticsearch.yml 中设置，需要重启节点（非动态）。需要商业许可。