Explanation
May 5, 2026
Database Audit Logging
An audit trail of every database action, tied to a real identity
What engine-native audit logs leave out
You get a database user, not a person
Engine logs show `app_user@10.0.0.5`, not Alice. With shared service accounts and pooled connections, the log can't tell you who actually ran the statement.
The statement without the story
A raw SQL line with no ticket, no approval, no reason, and no masking decision. You see what ran — not why it was allowed, or what the person actually saw.
Coverage scattered across engines
pgaudit here, a MySQL audit plugin there, SQL Server Audit, Oracle Unified Auditing — each with its own format, retention, and gaps. Assembling one trail across them is a project of its own.
How Bytebase records the workflow layer
Logged at the gateway, before it runs
Bytebase sits in front of the database and records every routed action before execution — the workflow layer engine-native logs miss.
Real identity, not a DB user
Every action is tied to an SSO identity, so the log names the person — not a shared service account.
Full statement and result
The complete SQL, target database, and execution result are recorded — queries, schema changes, and exports alike.
The context around it
Approval, reason, ticket, and masking decision travel with the record, so the log shows why an action was allowed, not just that it ran.
An audit trail auditors can actually read
One consistent record across every engine, with the fields compliance frameworks ask for — instead of stitching together per-engine logs.
One format, every engine
The same record shape across PostgreSQL, MySQL, SQL Server, Oracle, and 20+ engines — no per-engine dialect to normalize.
Mapped to frameworks
The fields SOC 2, HIPAA, PCI DSS, ISO 27001, and GDPR expect — who, what, when, from where — captured by default.
Export where you keep evidence
Stream the trail to your SIEM or archive, so retention and review live where the rest of your audit evidence does.
Both layers, so nothing falls through
Infrastructure logs from your cloud provider cover provisioning and config; Bytebase covers the workflow layer. Together they close the gap compliance requires.
Workflow layer, captured
Schema changes, queries, approvals, and exports through Bytebase are logged with identity and context.
Infrastructure layer, by your provider
CloudTrail, Cloud Audit Logs, and Azure Monitor record provisioning, config, and backups — Bytebase doesn't duplicate them.
Direct connections need a backstop
Connections that bypass Bytebase aren't in its log; engine-native auditing (pgaudit, SQL Server Audit, Oracle Unified Auditing) covers that path.
One audit trail, controls for every team
Integrations
Designed to integrate across modern enterprise environments
Bytebase connects to databases, developer tooling, and collaboration platforms to fit naturally into complex, multi-tool enterprise ecosystems.
Resources
