Sebastian Jerzykiewicz
04/03/2026, 1:24 PMRocky
04/03/2026, 1:25 PMfe.audit.log)
By default, StarRocks records all queries in a log file named fe.audit.log, located in the log/ directory of your Frontend (FE) nodes. This file captures detailed information, including:
* Timestamp of the query.
* User and Client IP.
* Execution time (queryTime).
* Resource consumption (CPU, memory, scan rows).
* The actual SQL statement.
You can configure the retention period and rotation of these logs using FE parameters like audit_log_roll_num and audit_log_delete_age (default is 7 days).
2. AuditLoader Plugin (Recommended for SQL Search)
If you want to search your query history using standard SQL, the most efficient way is to use the AuditLoader plugin. This plugin automatically parses the fe.audit.log and loads the data into a StarRocks table.
* How it works: It creates a system-level table (typically starrocks_audit_db*.starrocks_audit_tbl*) where every query execution is stored as a row.
* Search Example:
sql
SELECT queryId, queryTime, stmt
FROM starrocks_audit_db*.starrocks_audit_tbl*
WHERE user = 'root' AND queryTime > 1000; -- Find slow queries by root
* Benefit: Since the history is stored in a StarRocks table, you can perform complex analytics on your query patterns, performance trends, and resource usage directly.
3. SQL Digest (v3.3.6+)
If you are on version 3.3.6 or later, StarRocks supports SQL Digest. This feature generates a fingerprint for SQL statements by removing specific parameters. It allows you to:
* Group similar queries together even if they have different filter values.
* Track the most time-consuming "patterns" of queries in your history.
Summary of Setup
To get started with a searchable history table:
1. Enable Audit Logs: Ensure enable_audit_sql = true in your fe.conf.
2. Install AuditLoader: Follow the AuditLoader documentation to set up the automatic log-to-table pipeline.
3. Query away: Use standard SELECT statements on the audit table to find historical queries.
References
• faq/operation_maintenance_faq.md
• administration/management/logs.md
• administration/management/FE_configuration.md
• sql-reference/information_schema/be_logs.md
• administration/sql_digest.md
• administration/management/audit_loader.md