@Rocky I want to restrict a specific user to not set query_timeout in session parameter, I have already set session.timeout for user as 60sec but while querying user is setting session variable which is overriding this. How can I restrict that?

In StarRocks, it is currently not possible to strictly prevent a user from overriding session variables like

query_timeout

using the

SET

command or

SET_VAR

hints. In StarRocks, any user has the privilege to modify session-level variables for their own connection. While you can set a default value for a user using

ALTER USER jack SET PROPERTIES ('session.query_timeout' = '60')

(available from v3.3.3), this only initializes the session with that value; the user can still change it afterwards. To enforce a "hard" limit that a user cannot override, you should use Resource Groups. Recommended Approach: Resource Groups Resource Groups allow you to define resource consumption limits that are enforced at the system level and cannot be bypassed by session variable settings. You can use the

big_query_cpu_second_limit

parameter as a proxy for a timeout. 1. Create a Resource Group with a CPU time limit:

sql
    CREATE RESOURCE GROUP jack_hard_limit
    TO (user='jack') -- Matches the specific user
    WITH (
        "cpu_weight" = "10",
        "mem_limit" = "0.1",
        "big_query_cpu_second_limit" = "60", -- Hard limit: query kills if it uses > 60s of CPU time
        "big_query_mem_limit" = "2147483648" -- Hard limit: 2GB memory
    );

2. How it works: * Unlike

query_timeout

(which is based on wall-clock time),

big_query_cpu_second_limit

measures the actual cumulative CPU time consumed by the query on each BE node. * If a query exceeds this limit, StarRocks will terminate it with an error, even if the user manually set a higher

query_timeout

in their session. * This ensures that even if a user sets

query_timeout = 3600

, their query will still be killed if it consumes more than 60 seconds of CPU resources. Summary of Constraints * Session Variables: Cannot be "locked." Any user can run

SET query_timeout = ...

or use

/_+ SET_VAR(query_timeout=...) _/

. * User Properties: Useful for setting defaults but not for enforcing hard maximums. * Resource Groups: The only way to enforce mandatory limits on CPU, memory, and concurrency that a user cannot override. References • sql-reference/System_variable.md • faq/operation_maintenance_faq.md • administration/management/resource_management/Query_management.md • knowledge/usage/best-practice.md