Cyber Security Academy · Lesson

Auditing and Monitoring

Track database activity.

Auditing and Monitoring is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Audit the Database

Database auditing records who did what, when, and from where. It is essential for detecting misuse, investigating incidents, and proving compliance.

Access control prevents unauthorized actions; auditing tells you when controls were tested or bypassed.

What to Audit

Capture the events that matter for security and compliance:

Logins and failed login attempts.
Privilege and role changes (GRANT, REVOKE).
Schema changes (CREATE, ALTER, DROP).
Access to sensitive tables.
Bulk exports of data.

Native Audit Logging

Most engines ship an audit facility. Enable it rather than relying on application logs alone, because the database sees every query regardless of the client.

-- MySQL Enterprise / MariaDB audit plugin
INSTALL PLUGIN server_audit SONAME 'server_audit.so';
SET GLOBAL server_audit_logging = ON;
SET GLOBAL server_audit_events = 'CONNECT,QUERY,TABLE';

PostgreSQL pgAudit

PostgreSQL uses the pgAudit extension for detailed, structured audit logs that satisfy most compliance regimes.

-- enable session and object auditing
LOAD 'pgaudit';
ALTER SYSTEM SET pgaudit.log = 'write, ddl, role';
SELECT pg_reload_conf();

Failed Logins and Brute Force

Repeated failed logins from one source often signal a brute-force or credential-stuffing attack. Audit these and alert when a threshold is crossed.

Track failures per account and per source IP.
Lock or throttle after N failures.
Alert the security team in real time.

Monitoring vs Auditing

The two are related but different:

Auditing is the durable record of events for later review.
Monitoring is the real-time analysis that raises alerts.

You audit to logs, then monitor those logs to act quickly.

Forwarding to a SIEM

Send audit logs to a central SIEM (Security Information and Event Management) system. Centralizing logs prevents an attacker from erasing local evidence and enables correlation across systems.

# ship postgres logs to a syslog collector
# /etc/rsyslog.d/pg.conf
if $programname == 'postgres' then @@siem.internal:514
& stop

Detecting Anomalies

Define what normal looks like, then alert on deviations:

A read-only account suddenly running UPDATE.
Queries at 3 AM from an app that runs business hours only.
A single query returning millions of rows (possible exfiltration).

Protecting the Logs

Audit logs are themselves a target. Attackers try to delete or alter them to hide their tracks.

Write logs to append-only or remote storage.
Restrict who can read or purge audit data.
Use the database dba separation so app users cannot disable auditing.

Retention and Review

Auditing has value only if logs are kept and actually reviewed.

Set a retention period that meets policy (often 1 year or more).
Schedule periodic reviews, not just incident-time lookups.
Automate reports for compliance evidence.

Performance Considerations

Auditing adds overhead. Tune it so it does not cripple the database.

Audit sensitive tables and privileged actions, not every SELECT.
Offload log writes to a separate disk or stream.
Test the performance impact in staging first.

Quick Check

Distinguish auditing from monitoring.

Recap

Auditing and monitoring give visibility into database activity:

Audit logins, privilege changes, schema changes, and sensitive access.
Use native tools (pgAudit, audit plugins) plus a central SIEM.
Monitor logs to alert on anomalies in real time.
Protect, retain, and regularly review the logs.

Frequently asked questions

Is the “Auditing and Monitoring” lesson free?

Yes — the full text of “Auditing and Monitoring” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Auditing and Monitoring”?

Track database activity. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Auditing and Monitoring” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy