CloudWatch LogsのログデータをKinesis Data Firehose経由でS3に出力する

CloudWatch Logsのデータを、Kinesis Data Firehose経由でS3に出力する手順です。

#Amazon CloudWatch

#Amazon Data Firehose

#Amazon S3

#Amazon Kinesis

#AWS

坂巻一義

2020.05.10

この記事は公開されてから1年以上経過しています。情報が古い可能性がありますので、ご注意ください。

Lambda Functionなどで作り込みを行わず、CloudWatch LogsのログデータをS3に出力するには、Kinesis Data Firehoseが利用できます。

本エントリでは、Kinesis Data Firehoseを介して、CloudWatch LogsのデータをS3へ出力する設定を紹介しています。CloudWatch LogsからKinesis Data Firehoseへ出力するには、CloudWatch Logsのサブスクリプションフィルタの設定が必要になりますが、こちらの設定はマネジメントコンソールでは行えないので、関連する作業含めAWS CLIを利用して実施しています。さいごに、AWS CLIで構築した同様の構成を定義するCFnテンプレートも添付しています。

構成

S3への出力元となるCloudWatch Logs（ロググループ）の作成は割愛していますので、任意のロググループを利用してください。本エントリでは以下テンプレートの環境を利用しています。

CloudWatch Logsにログ出力するAurora MySQL 5.7のCFnテンプレート

事前準備

コマンドの再利用がしやすいよう、出力先のバケット名など環境変数に定義します。以下ハイライト部の値は任意で変更してください。

ACCOUNT_ID=`aws sts get-caller-identity --query 'Account' --output text` #AWSアカウントID
AWS_REGION=ap-northeast-1 #CloudWatch Logs出力先バケットを作成するリージョン
S3_BUCKET_NAME=test-cloudwatch-logs-`date '+%Y%m%d%H%M%S'` #CloudWatch Logs出力先のS3バケット名
FIREHOSE_ROLE_NAME=TestFirehosetoS3Role #Kinesis Data Firehoseサービスロール名
FIREHOSE_POLICY_NAME=Permissions-Policy-For-Firehose #Kinesis Data Firehoseサービスロールに設定するインラインポリシー名
FIREHOSE_DELIVERY_STREAM_NAME=test-delivery-stream #Kinesis Data Firehoseの配信ストリーム名
FIREHOSE_DELIVERY_STREAM_PREFIX=test-aurora-cluster/audit/
FIREHOSE_CWL_ERROR_LOG_GROUP_NAME=/aws/kinesisfirehose/${FIREHOSE_DELIVERY_STREAM_NAME}
FIREHOSE_TRUSTPOLICY_DOCUMENT_NAME=TrustPolicyForFirehose.json #Kinesis Data Firehoseサービスロール信頼関係ポリシードキュメント名（サービスロール作成時に一時的に利用）
FIREHOSE_PERMISSIONS_DOCUMENT_NAME=PermissionsForFirehose.json #Kinesis Data Firehoseサービスロールポリシードキュメント名（サービスロール作成時に一時的に利用）
CWL_ROLE_NAME=TestCWLtoKinesisFirehoseRole #CloudWatch Logsサービスロール名
CWL_POLICY_NAME=Permissions-Policy-For-CWL #CloudWatch Logsサービスロールに設定するインラインポリシー名
CWL_TRUSTPOLICY_DOCUMENT_NAME=TrustPolicyForCWL.json #CloudWatch Logsサービスロール信頼関係ポリシードキュメント名（サービスロール作成時に一時的に利用）
CWL_PERMISSIONS_DOCUMENT_NAME=PermissionsForCWL.json #CloudWatch Logsサービスロールポリシードキュメント名（サービスロール作成時に一時的に利用）
CWL_LOG_GROUP_NAME=/aws/rds/cluster/test-aurora-cluster/audit #サブスクリプションフィルタを設定するCloudWatch Logsロググループ名

意図した通りに設定されているか確認しましょう。

cat << ETX
  ACCOUNT_ID                            : ${ACCOUNT_ID}
  AWS_REGION                            : ${AWS_REGION}
  S3_BUCKET_NAME                        : ${S3_BUCKET_NAME}
  FIREHOSE_ROLE_NAME                    : ${FIREHOSE_ROLE_NAME}
  FIREHOSE_POLICY_NAME                  : ${FIREHOSE_POLICY_NAME}
  FIREHOSE_DELIVERY_STREAM_NAME         : ${FIREHOSE_DELIVERY_STREAM_NAME}
  FIREHOSE_DELIVERY_STREAM_PREFIX       : ${FIREHOSE_DELIVERY_STREAM_PREFIX}
  FIREHOSE_CWL_ERROR_LOG_GROUP_NAME     : ${FIREHOSE_CWL_ERROR_LOG_GROUP_NAME}
  FIREHOSE_TRUSTPOLICY_DOCUMENT_NAME    : ${FIREHOSE_TRUSTPOLICY_DOCUMENT_NAME}
  FIREHOSE_PERMISSIONS_DOCUMENT_NAME    : ${FIREHOSE_PERMISSIONS_DOCUMENT_NAME}
  CWL_ROLE_NAME                         : ${CWL_ROLE_NAME}
  CWL_POLICY_NAME                       : ${CWL_POLICY_NAME}
  CWL_TRUSTPOLICY_DOCUMENT_NAME         : ${CWL_TRUSTPOLICY_DOCUMENT_NAME}
  CWL_PERMISSIONS_DOCUMENT_NAME         : ${CWL_PERMISSIONS_DOCUMENT_NAME}
  CWL_LOG_GROUP_NAME                    : ${CWL_LOG_GROUP_NAME}
ETX

S3バケット作成

CloudWatch Logsデータの出力先となるS3バケットを作成します。以下create-bucketコマンドを実行します。

aws s3api create-bucket \
  --bucket ${S3_BUCKET_NAME} \
  --create-bucket-configuration LocationConstraint=${AWS_REGION}

正常にコマンドが実行されると、以下のような結果が返ってきます。

{
    "Location": "http://test-cloudwatch-logs-20200505091255.s3.amazonaws.com/"
}

Kinesis Data Firehose

IAMロール作成

Kinesis Data Firehoseに、S3バケットへデータを出力する権限を与えます。Kinesis Data FirehoseにIAMロールを引き受けられるようにしますので、後続のコマンドで使用する信頼ポリシーのドキュメントを作成します。以下コマンドを実行すると、カレントディレクトリにTrustPolicyForFirehose.jsonファイルが作成されます。

cat <<EOF > ./${FIREHOSE_TRUSTPOLICY_DOCUMENT_NAME}
{
  "Statement": {
    "Effect": "Allow",
    "Principal": { "Service": "firehose.amazonaws.com" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId":"${ACCOUNT_ID}" } }
  }
}
EOF

ファイルが作成されたことを確認します。

ls -l ${FIREHOSE_TRUSTPOLICY_DOCUMENT_NAME}

create-roleコマンドを実行して、 Kinesis Data Firehoseが利用するIAMロールを作成します。

KINESIS_FIREHOSE_ROLE_ARN=`aws iam create-role \
  --role-name ${FIREHOSE_ROLE_NAME} \
  --assume-role-policy-document file://./${FIREHOSE_TRUSTPOLICY_DOCUMENT_NAME} \
  --query 'Role.Arn' \
  --output text`

正常にコマンドが実行できると、IAMロールのARNが変数に格納されていますので、変数の値を確認しましょう。

echo ${KINESIS_FIREHOSE_ROLE_ARN}

この後、IAMロールにポリシーを設定するので、list-role-policiesコマンドを実行して、設定前の状態を確認します。このタイミングではポリシーは付与されていません。

aws iam list-role-policies \
  --role-name ${FIREHOSE_ROLE_NAME}

IAMロールにS3バケットへの権限を与えていきます。権限付与は後続で実施しますので、ここでは付与する権限をファイルに書き出します。以下コマンドを実行すると、カレントディレクトリにPermissionsForFirehose.jsonファイルが作成されます。

cat <<EOF > ./${FIREHOSE_PERMISSIONS_DOCUMENT_NAME}
{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
          "s3:AbortMultipartUpload",
          "s3:GetBucketLocation",
          "s3:GetObject",
          "s3:ListBucket",
          "s3:ListBucketMultipartUploads",
          "s3:PutObject",
          "logs:PutLogEvents"
      ],
      "Resource": [
          "arn:aws:s3:::${S3_BUCKET_NAME}",
          "arn:aws:s3:::${S3_BUCKET_NAME}/*",
          "arn:aws:logs:${AWS_REGION}:${ACCOUNT_ID}:log-group:${FIREHOSE_CWL_ERROR_LOG_GROUP_NAME}:log-stream:*"
      ]
    }
  ]
}
EOF

ファイルが作成されたことを確認します。

ls -l ${FIREHOSE_PERMISSIONS_DOCUMENT_NAME}

put-role-policyコマンドを実行して、IAMロールにポリシーを設定します。

aws iam put-role-policy \
  --role-name ${FIREHOSE_ROLE_NAME} \
  --policy-name ${FIREHOSE_POLICY_NAME} \
  --policy-document file://./${FIREHOSE_PERMISSIONS_DOCUMENT_NAME}

IAMロールにポリシーが設定されたことを確認します。

aws iam list-role-policies \
  --role-name ${FIREHOSE_ROLE_NAME}

ロググループ作成

Kinesis Data Firehoseにてエラーログの記録を有効にする場合かつ、マネジメントコンソール以外で配信ストリームを作成する場合は、ロググループ、ログストリームを事前に作成する必要があります。

CloudWatch Logs を使用した Kinesis Data Firehose のモニタリング

CloudWatch Logsにロググループを作成します。以下create-log-groupコマンドを実行します。

aws logs create-log-group \
  --log-group-name ${FIREHOSE_CWL_ERROR_LOG_GROUP_NAME}

ログストリームを作成します。以下create-log-streamコマンドを実行します。

aws logs create-log-stream \
  --log-group-name ${FIREHOSE_CWL_ERROR_LOG_GROUP_NAME} \
  --log-stream-name "S3Delivery"

describe-log-streamsコマンドを実行して、ロググループ、ストリームが作成できたことを確認します。

aws logs describe-log-streams \
  --log-group-name ${FIREHOSE_CWL_ERROR_LOG_GROUP_NAME}

配信ストリーム作成

create-delivery-streamコマンドを実行して、S3バケットへデータを出力する配信ストリームを作成します。

KINESIS_FIREHOSE_ARN=`aws firehose create-delivery-stream \
  --delivery-stream-name ${FIREHOSE_DELIVERY_STREAM_NAME} \
  --s3-destination-configuration \
    '{"RoleARN": "'${KINESIS_FIREHOSE_ROLE_ARN}'","BucketARN": "arn:aws:s3:::'${S3_BUCKET_NAME}'","Prefix": "'${FIREHOSE_DELIVERY_STREAM_PREFIX}'","CloudWatchLoggingOptions": { "Enabled": true, "LogGroupName": "'/aws/kinesisfirehose/${FIREHOSE_DELIVERY_STREAM_NAME}'", "LogStreamName": "S3Delivery"},"BufferingHints": { "SizeInMBs": 1, "IntervalInSeconds": 60 }}' \
  --query 'DeliveryStreamARN' \
  --output text`

上記コマンド（作成する配信ストリーム）について補足します。CloudWatch LogsからKinesis Data Firehoseに送信されたデータは、すでにgzipに圧縮されているため、配信ストリーム内で圧縮を使用する必要はありません。プレフィックスは指定していますがカスタマイズ指定は行っていないので、指定したプレフィックス（ここではtest-aurora-cluster/audit/）配下に、「YYYY/MM/DD/HH（UTC）」形式でオブジェクトが出力されます。

配信ストリームの詳細設定については、データ量などを考慮し以下を参考に設定してください。

describe-delivery-streamコマンドを実行して、作成した配信ストリームの状態を確認します。

aws firehose describe-delivery-stream \
  --delivery-stream-name ${FIREHOSE_DELIVERY_STREAM_NAME} \
  --query 'DeliveryStreamDescription.DeliveryStreamStatus' \
  --output text

出力された結果がCREATINGからACTIVEに変われば作成完了です。

CloudWatch Logs

CloudWatch Logsに、Kinesis Data Firehose配信ストリームへ出力する権限を与えます。

CloudWatch Logsがロールを引き受けられるようにしますので、後続のコマンドで使用する信頼ポリシーのドキュメントを作成します。以下コマンドを実行すると、カレントディレクトリにTrustPolicyForCWL.jsonファイルが作成されます。

IAMロール作成

cat <<EOF > ./${CWL_TRUSTPOLICY_DOCUMENT_NAME}
{
  "Statement": {
    "Effect": "Allow",
    "Principal": { "Service": "logs.${AWS_REGION}.amazonaws.com" },
    "Action": "sts:AssumeRole"
  }
}
EOF

ファイルが作成されたことを確認します。

ls -l ${CWL_TRUSTPOLICY_DOCUMENT_NAME}

create-roleコマンドを実行して、CloudWatch Logsが利用するIAMロールを作成します。

CWL_ROLE_ARN=`aws iam create-role \
  --role-name ${CWL_ROLE_NAME} \
  --assume-role-policy-document file://./${CWL_TRUSTPOLICY_DOCUMENT_NAME} \
  --query 'Role.Arn' \
  --output text`

正常にコマンドが実行できると、IAMロールのARNが変数に格納されます。変数の値を確認しましょう。

echo ${CWL_ROLE_ARN}

aws iam list-role-policies \
  --role-name ${CWL_ROLE_NAME}

IAMロールにKinesis Data Firehose配信ストリームへの権限を与えていきますので、後続のコマンドで利用するポリシードキュメントを作成します。以下コマンドを実行すると、カレントディレクトリにPermissionsForCWL.jsonファイルが作成されます。

cat <<EOF > ./${CWL_PERMISSIONS_DOCUMENT_NAME}
{
    "Statement":[
      {
        "Effect":"Allow",
        "Action":["firehose:*"],
        "Resource":["arn:aws:firehose:${AWS_REGION}:${ACCOUNT_ID}:*"]
      },
      {
        "Effect":"Allow",
        "Action":["iam:PassRole"],
        "Resource":["arn:aws:iam::${ACCOUNT_ID}:role/${CWL_ROLE_NAME}"]
      }
    ]
}
EOF

ファイルが作成されたことを確認します。

ls -l ${CWL_PERMISSIONS_DOCUMENT_NAME}

put-role-policyコマンドを実行して、IAMロールへポリシーを設定します。

aws iam put-role-policy \
  --role-name ${CWL_ROLE_NAME} \
  --policy-name ${CWL_POLICY_NAME} \
  --policy-document file://./${CWL_PERMISSIONS_DOCUMENT_NAME}

IAMロールにポリシーが設定されたことを確認します。

aws iam list-role-policies \
  --role-name ${CWL_ROLE_NAME}

サブスクリプションフィルタ設定

Kinesis Data Firehoseへ出力するサブスクリプションフィルタの設定を行っていきます。

describe-subscription-filtersコマンドを実行して、設定前の状態を確認します。このタイミングではサブスクリプションフィルタの設定はありません。

aws logs describe-subscription-filters \
  --log-group-name "${CWL_LOG_GROUP_NAME}"

put-subscription-filterコマンドを実行して、サブスクリプションフィルタを作成します。ここでは、サブスクリプションフィルタのフィルターパターンは""にしてすべてのログイベントを出力しています。

フィルターとパターンの構文

aws logs put-subscription-filter \
    --log-group-name "${CWL_LOG_GROUP_NAME}" \
    --filter-name "Destination" \
    --filter-pattern "" \
    --destination-arn "${KINESIS_FIREHOSE_ARN}" \
    --role-arn "${CWL_ROLE_ARN}"

作成したサブスクリプションフィルタを確認します。

aws logs describe-subscription-filters \
  --log-group-name "${CWL_LOG_GROUP_NAME}"

ログ確認

サブスクリプションフィルタを設定したロググループにロギングが行われると、Kinesis Data Firehoseを通してS3にログ（オブジェクト）が出力されます。

list-objectsコマンドを実行して、出力されたログを確認します。

aws s3api list-objects \
  --bucket ${S3_BUCKET_NAME} \
  --prefix 'test-aurora-cluster/audit/' \
  --query 'Contents[].Key' \
  --output table

こんな感じで出力されていました。

-----------------------------------------------------------------------------------------------------------------------------
|                                                        ListObjects                                                        |
+---------------------------------------------------------------------------------------------------------------------------+
|  test-aurora-cluster/audit/2020/05/05/00/test-delivery-stream-1-2020-05-05-00-52-17-e5d8e05b-ce35-4b9a-a329-409c661a9679  |
|  test-aurora-cluster/audit/2020/05/05/00/test-delivery-stream-1-2020-05-05-00-53-17-506862d8-534c-47aa-a70d-d7f64b8b56e0  |
+---------------------------------------------------------------------------------------------------------------------------+

ログの内容を確認したいので、S3から任意のオブジェクトを取得していきたいと思います。任意のオブジェクトキーを取得（変数に格納）します。

S3_OBJECT_KEY=`aws s3api list-objects \
  --bucket ${S3_BUCKET_NAME} \
  --prefix 'test-aurora-cluster/audit/' \
  --query 'Contents[0].Key' \
  --output text`

正常にコマンドが実行できると、キーが変数に格納されています。

echo ${S3_OBJECT_KEY}

get-object コマンドを実行して、ログを取得します。

aws s3api get-object \
  --bucket ${S3_BUCKET_NAME} \
  --key ${S3_OBJECT_KEY} testfile.gz

指定したログがtestfile.gzとして保存されます。アカウントIDをマスクしていますが、以下のようにログデータを確認することができました。

$ gzcat testfile.gz
{"messageType":"CONTROL_MESSAGE","owner":"CloudwatchLogs","logGroup":"","logStream":"","subscriptionFilters":[],"logEvents":[{"id":"","timestamp":1588639937096,"message":"CWL CONTROL MESSAGE: Checking health of destination Firehose."}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854555160047657750278786662005165823542984051261440","timestamp":1588639941839,"message":"1588639941839440,test-aurora-master-instance,rdsadmin,localhost,4,7914,QUERY,mysql,'COMMIT',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854555539160326125299380020612093771654018125856768","timestamp":1588639941856,"message":"1588639941856421,test-aurora-master-instance,rdsadmin,localhost,4,7915,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427854559664798187853464661204719974211600896732233729","timestamp":1588639942041,"message":"1588639942041281,test-aurora-master-instance,rdsadmin,localhost,2,7916,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854559687098933051995284346255692484249258238214146","timestamp":1588639942042,"message":"1588639942042515,test-aurora-master-instance,rdsadmin,localhost,2,7918,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854595479794976693645427705578640452376470932881408","timestamp":1588639943647,"message":"1588639943647430,test-aurora-master-instance,rdsadmin,localhost,73,7919,QUERY,mysql,'SELECT VARIABLE_NAME, VARIABLE_VALUE FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME IN (\\'QCACHE_HITS\\', \\'COM_SELECT\\', \\'INNODB_BUFFER_POOL_READS\\', \\'INNODB_BUFFER_POOL_READ_REQUESTS\\')',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854597442260554164340265332309656964008178880217088","timestamp":1588639943735,"message":"1588639943735153,test-aurora-master-instance,rdsadmin,localhost,73,7922,QUERY,mysql,'SELECT VARIABLE_NAME, VARIABLE_VALUE FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME IN ( \\'ABORTED_CONNECTS\\', \\'QUERIES\\', \\'THREADS_CONNECTED\\')',0"},{"id":"35427854597821373222539360858738416867599030324481884161","timestamp":1588639943752,"message":"1588639943752590,test-aurora-master-instance,rdsadmin,localhost,4,7924,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854598914109737267361392673667062958800038274924546","timestamp":1588639943801,"message":"1588639943801757,test-aurora-master-instance,rdsadmin,localhost,73,7926,QUERY,mysql,'SELECT NAME, COUNT FROM INFORMATION_SCHEMA.INNODB_METRICS WHERE NAME IN (\\'LOCK_DEADLOCKS\\', \\'LOCK_ROW_LOCK_CURRENT_WAITS\\', \\'TRX_ACTIVE_TRANSACTIONS\\')',0"},{"id":"35427854599159417934451198247230559963957932014840709123","timestamp":1588639943812,"message":"1588639943812961,test-aurora-master-instance,rdsadmin,localhost,73,7927,QUERY,mysql,'SELECT @@GLOBAL.aurora_backtrack_enabled',1193"},{"id":"35427854599716936564414463825768952920774141052490219524","timestamp":1588639943837,"message":"1588639943837722,test-aurora-master-instance,rdsadmin,localhost,4,7929,QUERY,mysql,'COMMIT',0"},{"id":"35427854599739237309612994448910488639046789413996199941","timestamp":1588639943838,"message":"1588639943838818,test-aurora-master-instance,rdsadmin,localhost,4,7930,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427854602013913319863118009347131902856922287606202374","timestamp":1588639943940,"message":"1588639943940195,test-aurora-master-instance,rdsadmin,localhost,74,7934,QUERY,,'SET SESSION autocommit=1',0"},{"id":"35427854603686469209752914744962310773305549400554733575","timestamp":1588639944015,"message":"1588639944015443,test-aurora-master-instance,rdsadmin,localhost,74,7936,QUERY,,'/* mysql-connector-java-5.1.33 ( Revision: alexander.soklakov@oracle.com-20140908134200-8ukofe1izi0r2b63 ) */SELECT @@session.auto_increment_increment',0"},{"id":"35427854603820273680944098483811525082941439569590616072","timestamp":1588639944021,"message":"1588639944021488,test-aurora-master-instance,rdsadmin,localhost,74,7937,QUERY,,'SET NAMES utf8',0"},{"id":"35427854604266288584914710946642239448394406799710224393","timestamp":1588639944041,"message":"1588639944041215,test-aurora-master-instance,rdsadmin,localhost,2,7940,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427854604266288584914710946642239448394406799710224394","timestamp":1588639944041,"message":"1588639944041715,test-aurora-master-instance,rdsadmin,localhost,2,7941,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854601567898415892505546613279559442415711495651328","timestamp":1588639943920,"message":"1588639943920767,test-aurora-master-instance,rdsadmin,localhost,74,7933,QUERY,,'SET SESSION sql_mode=0',0"},{"id":"35427854604243987839716180323597565752160219092213301249","timestamp":1588639944040,"message":"1588639944040796,test-aurora-master-instance,rdsadmin,localhost,2,7939,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854604266288584914710946739101470432867453719281666","timestamp":1588639944041,"message":"1588639944041700,test-aurora-master-instance,rdsadmin,localhost,74,7938,QUERY,,'SET character_set_results = NULL',0"},{"id":"35427854604600799762892670293862137244522592876308987907","timestamp":1588639944056,"message":"1588639944056650,test-aurora-master-instance,rdsadmin,localhost,74,7942,QUERY,,'SET autocommit=1',0"},{"id":"35427854605938844474804507682354280340881494566667812868","timestamp":1588639944116,"message":"1588639944116783,test-aurora-master-instance,rdsadmin,localhost,74,7943,QUERY,,'SET sql_mode=\\'STRICT_TRANS_TABLES\\'',0"},{"id":"35427854606518663849966303884034209015970351965823303685","timestamp":1588639944142,"message":"1588639944142133,test-aurora-master-instance,rdsadmin,localhost,74,7945,QUERY,,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854606518663849966303884034209015970351965823303686","timestamp":1588639944142,"message":"1588639944142588,test-aurora-master-instance,rdsadmin,localhost,74,7946,QUERY,,'SELECT MIN(REPLICA_LAG_IN_MILLISECONDS), MAX(REPLICA_LAG_IN_MILLISECONDS) FROM INFORMATION_SCHEMA.REPLICA_HOST_STATUS WHERE SERVER_ID != \\'test-aurora-master-instance\\'',0"},{"id":"35427854606540964595164834507175744734243000327329284103","timestamp":1588639944143,"message":"1588639944143364,test-aurora-master-instance,rdsadmin,localhost,74,7947,QUERY,,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854641798442754041749696272062028661575183611527168","timestamp":1588639945724,"message":"1588639945724944,test-aurora-master-instance,rdsadmin,localhost,4,7948,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427854644073118764291873256708705292471708057221529601","timestamp":1588639945826,"message":"1588639945826343,test-aurora-master-instance,rdsadmin,localhost,4,7952,QUERY,mysql,'COMMIT',0"},{"id":"35427854648733974510784773493289670411455215611971436546","timestamp":1588639946035,"message":"1588639946035882,test-aurora-master-instance,rdsadmin,localhost,2,7955,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427854648733974510784773493289670411455215611971436547","timestamp":1588639946035,"message":"1588639946035971,test-aurora-master-instance,rdsadmin,localhost,2,7956,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854688250895002581037702513493711027796503096262656","timestamp":1588639947807,"message":"1588639947807096,test-aurora-master-instance,rdsadmin,localhost,4,7959,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639947739) ON DUPLICATE KEY UPDATE value = 1588639947739',0"},{"id":"35427854688295496492978098948796565147573093226108223489","timestamp":1588639947809,"message":"1588639947809500,test-aurora-master-instance,rdsadmin,localhost,4,7960,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854689098323320125201381891851005388434240323518466","timestamp":1588639947845,"message":"1588639947845335,test-aurora-master-instance,rdsadmin,localhost,4,7962,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427854693201660436654836039934423167555732757423915011","timestamp":1588639948029,"message":"1588639948029299,test-aurora-master-instance,rdsadmin,localhost,2,7963,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854693201660436654836039934423167555732757423915012","timestamp":1588639948029,"message":"1588639948029748,test-aurora-master-instance,rdsadmin,localhost,2,7964,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427854693223961181853366663075958885828381118929895429","timestamp":1588639948030,"message":"1588639948030565,test-aurora-master-instance,rdsadmin,localhost,2,7965,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854686734444329080955329093489088639107308146065408","timestamp":1588639947739,"message":"1588639947739523,test-aurora-master-instance,rdsadmin,localhost,4,7957,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427854709213595489199823455761493107468655706174324737","timestamp":1588639948747,"message":"1588639948747854,test-aurora-master-instance,rdsadmin,localhost,74,7969,QUERY,,'SELECT @@GLOBAL.aurora_backtrack_enabled',1193"},{"id":"35427854709927219335552803396290636092193403274365698050","timestamp":1588639948779,"message":"1588639948779742,test-aurora-master-instance,rdsadmin,localhost,75,7971,QUERY,,'SET SESSION wait_timeout=28800',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854686845948055073608444644113243948162275513335808","timestamp":1588639947744,"message":"1588639947744522,test-aurora-master-instance,rdsadmin,localhost,4,7958,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854687894083079404547732296292002762635266294415361","timestamp":1588639947791,"message":"1588639947791436,test-aurora-master-instance,rdsadmin,localhost,4,7959,WRITE,mysql,rds_heartbeat2,"},{"id":"35427854689009120339331078889373077916395053341593436162","timestamp":1588639947841,"message":"1588639947841052,test-aurora-master-instance,rdsadmin,localhost,4,7961,QUERY,mysql,'COMMIT',0"},{"id":"35427854707808648541692394197687688420237622091134926851","timestamp":1588639948684,"message":"1588639948684590,test-aurora-master-instance,rdsadmin,localhost,2,7966,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854707830949286890924820829224138510270452640907268","timestamp":1588639948685,"message":"1588639948685060,test-aurora-master-instance,rdsadmin,localhost,2,7967,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427854707830949286890924820829224138510270452640907269","timestamp":1588639948685,"message":"1588639948685392,test-aurora-master-instance,rdsadmin,localhost,2,7968,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854716416736188325214731512012605485600975496937472","timestamp":1588639949070,"message":"1588639949070882,test-aurora-master-instance,rdsadmin,localhost,75,7982,QUERY,,'SELECT @@GLOBAL.aurora_backtrack_enabled',1193"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854709615008902773374673302780287392044450839068672","timestamp":1588639948765,"message":"1588639948765885,test-aurora-master-instance,rdsadmin,localhost,74,0,DISCONNECT,,,0"},{"id":"35427854709637309647971905296444316005664692812345049089","timestamp":1588639948766,"message":"1588639948766759,test-aurora-master-instance,rdsadmin,localhost,75,0,CONNECT,,,0"},{"id":"35427854710127926042339579005558101807662956765476618242","timestamp":1588639948788,"message":"1588639948788090,test-aurora-master-instance,rdsadmin,localhost,75,7972,QUERY,,'SET SESSION time_zone=UTC',0"},{"id":"35427854711488271499449947017191780622294506817341423619","timestamp":1588639948849,"message":"1588639948849061,test-aurora-master-instance,rdsadmin,localhost,75,7973,QUERY,,'SET SESSION sql_mode=0',0"},{"id":"35427854712201895345802926957720923607019254385532796932","timestamp":1588639948881,"message":"1588639948881648,test-aurora-master-instance,rdsadmin,localhost,75,7975,QUERY,,'/* mysql-connector-java-5.1.33 ( Revision: alexander.soklakov@oracle.com-20140908134200-8ukofe1izi0r2b63 ) */SHOW VARIABLES WHERE Variable_name =\\'language\\' OR Variable_name = \\'net_write_timeout\\' OR Variable_name = \\'interactive_timeout\\' OR Variable_name = \\'wait_timeout\\' OR Variable_name = \\'character_set_client\\' OR Variable_name = \\'character_set_connection\\' OR Variable_name = \\'character_set\\' OR Variable_name = \\'character_set_server\\' OR Variable_name = \\'tx_isolation\\' OR Variable_name = \\'transaction_isolation\\' OR Variable_name = \\'character_set_results\\' OR Variable_name = \\'timezone\\' OR Variable_name = \\'time_zone\\' OR Variable_name = \\'system_time_zone\\' OR Variable_name = \\'lower_case_table_names\\' OR Variable_name = \\'max_allowed_packet\\' OR Variable_name = \\'net_buffer_length\\' OR Variable_name = \\'sql_mode\\' OR Variable_name = \\'query_cache_type\\' OR Variable_name = \\'query_cache_size\\' OR Variable_name = \\'license\\' OR Variable_name = \\'init_connect\\'',0"},{"id":"35427854714142060178075091171034531096739661836553093125","timestamp":1588639948968,"message":"1588639948968822,test-aurora-master-instance,rdsadmin,localhost,75,7978,QUERY,,'SET character_set_results = NULL',0"},{"id":"35427854714454270610854519895016031152556738897636818950","timestamp":1588639948982,"message":"1588639948982655,test-aurora-master-instance,rdsadmin,localhost,75,7979,QUERY,,'SET autocommit=1',0"},{"id":"35427854715993022029553132891781995713369475841549467655","timestamp":1588639949051,"message":"1588639949051670,test-aurora-master-instance,rdsadmin,localhost,75,7981,QUERY,,'SHOW WARNINGS',0"},{"id":"35427854716706645875906112832311138698094223409740840968","timestamp":1588639949083,"message":"1588639949083019,test-aurora-master-instance,rdsadmin,localhost,75,0,DISCONNECT,,,0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854711889684913023498233824156380222049830971179008","timestamp":1588639948867,"message":"1588639948867314,test-aurora-master-instance,rdsadmin,localhost,75,7974,QUERY,,'SET SESSION autocommit=1',0"},{"id":"35427854712358000562192641319796406463947665422596767745","timestamp":1588639948888,"message":"1588639948888728,test-aurora-master-instance,rdsadmin,localhost,75,7976,QUERY,,'/* mysql-connector-java-5.1.33 ( Revision: alexander.soklakov@oracle.com-20140908134200-8ukofe1izi0r2b63 ) */SELECT @@session.auto_increment_increment',0"},{"id":"35427854713718346019303009331430085278579215474461573122","timestamp":1588639948949,"message":"1588639948949618,test-aurora-master-instance,rdsadmin,localhost,75,7977,QUERY,,'SET NAMES utf8',0"},{"id":"35427854714654977317641295503374585446030446657712750595","timestamp":1588639948991,"message":"1588639948991181,test-aurora-master-instance,rdsadmin,localhost,75,7980,QUERY,,'SET sql_mode=\\'STRICT_TRANS_TABLES\\'',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854742084893911833961968685713486667366672577396736","timestamp":1588639950221,"message":"1588639950221468,test-aurora-master-instance,rdsadmin,localhost,76,8002,QUERY,,'SET NAMES utf8',0"},{"id":"35427854742307901363819268200101070669393850287637200897","timestamp":1588639950231,"message":"1588639950231223,test-aurora-master-instance,rdsadmin,localhost,76,8004,QUERY,,'SET autocommit=1',0"},{"id":"35427854743690547566128166834876285202298048701007986690","timestamp":1588639950293,"message":"1588639950293497,test-aurora-master-instance,rdsadmin,localhost,76,8005,QUERY,,'SET sql_mode=\\'STRICT_TRANS_TABLES\\'',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854732294866769679018409609421773977774388435484672","timestamp":1588639949782,"message":"1588639949782712,test-aurora-master-instance,rdsadmin,localhost,4,7985,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854732562475712061385887307850393249554726507249665","timestamp":1588639949794,"message":"1588639949794198,test-aurora-master-instance,rdsadmin,localhost,4,7986,WRITE,mysql,rds_heartbeat2,"},{"id":"35427854732963889125634937103855493322157225233614897154","timestamp":1588639949812,"message":"1588639949812912,test-aurora-master-instance,rdsadmin,localhost,4,7987,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854733164595832421712712129314786611060487168720899","timestamp":1588639949821,"message":"1588639949821135,test-aurora-master-instance,rdsadmin,localhost,4,7988,QUERY,mysql,'COMMIT',0"},{"id":"35427854734591843525127672593187600756060555623551467524","timestamp":1588639949885,"message":"1588639949885128,test-aurora-master-instance,rdsadmin,localhost,4,7989,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427854739118894800429389090919351565408173009265491973","timestamp":1588639950088,"message":"1588639950088207,test-aurora-master-instance,rdsadmin,localhost,76,0,CONNECT,,,0"},{"id":"35427854739118894800429389090919351565408173009265491974","timestamp":1588639950088,"message":"1588639950088322,test-aurora-master-instance,rdsadmin,localhost,2,7990,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854739118894800429389090919351565408173009265491975","timestamp":1588639950088,"message":"1588639950088880,test-aurora-master-instance,rdsadmin,localhost,2,7991,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427854739141195545627919714060887283680821370771472392","timestamp":1588639950089,"message":"1588639950089086,test-aurora-master-instance,rdsadmin,localhost,2,7992,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"},{"id":"35427854739141195545627919714060887283680821370771472393","timestamp":1588639950089,"message":"1588639950089097,test-aurora-master-instance,rdsadmin,localhost,76,7993,QUERY,,'SET SESSION wait_timeout=28800',0"},{"id":"35427854739765616411186777162023887395314975492938924042","timestamp":1588639950117,"message":"1588639950117126,test-aurora-master-instance,rdsadmin,localhost,76,7994,QUERY,,'SET SESSION time_zone=UTC',0"},{"id":"35427854739787917156385307785165423113587623854444904459","timestamp":1588639950118,"message":"1588639950118206,test-aurora-master-instance,rdsadmin,localhost,2,7997,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"},{"id":"35427854739854819391980899654590030268405568938962845708","timestamp":1588639950121,"message":"1588639950121009,test-aurora-master-instance,rdsadmin,localhost,76,7999,QUERY,,'SET SESSION autocommit=1',0"},{"id":"35427854739966323117973552770297708859768810746492747789","timestamp":1588639950126,"message":"1588639950126291,test-aurora-master-instance,rdsadmin,localhost,76,8000,QUERY,,'/* mysql-connector-java-5.1.33 ( Revision: alexander.soklakov@oracle.com-20140908134200-8ukofe1izi0r2b63 ) */SHOW VARIABLES WHERE Variable_name =\\'language\\' OR Variable_name = \\'net_write_timeout\\' OR Variable_name = \\'interactive_timeout\\' OR Variable_name = \\'wait_timeout\\' OR Variable_name = \\'character_set_client\\' OR Variable_name = \\'character_set_connection\\' OR Variable_name = \\'character_set\\' OR Variable_name = \\'character_set_server\\' OR Variable_name = \\'tx_isolation\\' OR Variable_name = \\'transaction_isolation\\' OR Variable_name = \\'character_set_results\\' OR Variable_name = \\'timezone\\' OR Variable_name = \\'time_zone\\' OR Variable_name = \\'system_time_zone\\' OR Variable_name = \\'lower_case_table_names\\' OR Variable_name = \\'max_allowed_packet\\' OR Variable_name = \\'net_buffer_length\\' OR Variable_name = \\'sql_mode\\' OR Variable_name = \\'query_cache_type\\' OR Variable_name = \\'query_cache_size\\' OR Variable_name = \\'license\\' OR Variable_name = \\'init_connect\\'',0"},{"id":"35427854742218698383025145707592816405306295258596769806","timestamp":1588639950227,"message":"1588639950227867,test-aurora-master-instance,rdsadmin,localhost,76,8003,QUERY,,'SET character_set_results = NULL',0"},{"id":"35427854744314968431687024282897173922935241240158928911","timestamp":1588639950321,"message":"1588639950321871,test-aurora-master-instance,rdsadmin,localhost,76,8006,QUERY,,'SHOW WARNINGS',0"},{"id":"35427854744471073648076738644887923950843779770700791824","timestamp":1588639950328,"message":"1588639950328325,test-aurora-master-instance,rdsadmin,localhost,76,8007,QUERY,,'SELECT @@aurora_version',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854730778416096178936036072084037552582832705372160","timestamp":1588639949714,"message":"1588639949714191,test-aurora-master-instance,rdsadmin,localhost,4,7984,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427854739765616411186777162110978501429872519615479809","timestamp":1588639950117,"message":"1588639950117001,test-aurora-master-instance,rdsadmin,localhost,2,7995,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854739765616411186777162110978501429872519615479810","timestamp":1588639950117,"message":"1588639950117604,test-aurora-master-instance,rdsadmin,localhost,2,7996,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427854739787917156385307785252514219702520881121460227","timestamp":1588639950118,"message":"1588639950118217,test-aurora-master-instance,rdsadmin,localhost,76,7998,QUERY,,'SET SESSION sql_mode=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854732718580928451100249345904330097947257901744128","timestamp":1588639949801,"message":"1588639949801974,test-aurora-master-instance,rdsadmin,localhost,4,7986,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639949714) ON DUPLICATE KEY UPDATE value = 1588639949714',0"},{"id":"35427854741438172301076573897686370174703456606740086785","timestamp":1588639950192,"message":"1588639950192406,test-aurora-master-instance,rdsadmin,localhost,76,8001,QUERY,,'/* mysql-connector-java-5.1.33 ( Revision: alexander.soklakov@oracle.com-20140908134200-8ukofe1izi0r2b63 ) */SELECT @@session.auto_increment_increment',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854782583047192365573596131400881132010038871064576","timestamp":1588639952037,"message":"1588639952037912,test-aurora-master-instance,rdsadmin,localhost,2,8014,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854782627648682762634842414472317677306761883025409","timestamp":1588639952039,"message":"1588639952039289,test-aurora-master-instance,rdsadmin,localhost,2,8016,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854775759019161615202914734280258049252447181275136","timestamp":1588639951731,"message":"1588639951731910,test-aurora-master-instance,rdsadmin,localhost,4,8009,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854777498477287100591519774066283315824644647747585","timestamp":1588639951809,"message":"1588639951809934,test-aurora-master-instance,rdsadmin,localhost,4,8010,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639951727) ON DUPLICATE KEY UPDATE value = 1588639951727',0"},{"id":"35427854778212101133453571460303209268040572212839120898","timestamp":1588639951841,"message":"1588639951841723,test-aurora-master-instance,rdsadmin,localhost,4,8012,QUERY,mysql,'COMMIT',0"},{"id":"35427854780018461494534551934767602448125089494823534595","timestamp":1588639951922,"message":"1588639951922393,test-aurora-master-instance,rdsadmin,localhost,4,8013,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854777431575051504999650396267089262916722954272768","timestamp":1588639951806,"message":"1588639951806461,test-aurora-master-instance,rdsadmin,localhost,4,8010,WRITE,mysql,rds_heartbeat2,"},{"id":"35427854778055995917063857098359267200897070845121724417","timestamp":1588639951834,"message":"1588639951834273,test-aurora-master-instance,rdsadmin,localhost,4,8011,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854782605347937564104219232553728517336592341729282","timestamp":1588639952038,"message":"1588639952038272,test-aurora-master-instance,rdsadmin,localhost,2,8015,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854775669816180821080422309711306338409178047512576","timestamp":1588639951727,"message":"1588639951727323,test-aurora-master-instance,rdsadmin,localhost,4,8008,QUERY,mysql,'SET @@sql_log_bin=off',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854822233772155353021544129281855593488082555764736","timestamp":1588639953815,"message":"1588639953815024,test-aurora-master-instance,rdsadmin,localhost,4,8019,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639953774) ON DUPLICATE KEY UPDATE value = 1588639953774',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854821319441602213265995370029801104274119270203392","timestamp":1588639953774,"message":"1588639953774377,test-aurora-master-instance,rdsadmin,localhost,4,8017,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427854821988463958169184689616101349283724964449615873","timestamp":1588639953804,"message":"1588639953804235,test-aurora-master-instance,rdsadmin,localhost,4,8018,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854822055366193764776559040708504101670048967557122","timestamp":1588639953807,"message":"1588639953807048,test-aurora-master-instance,rdsadmin,localhost,4,8019,WRITE,mysql,rds_heartbeat2,"},{"id":"35427854823571816867264858932665137346641758631374225411","timestamp":1588639953875,"message":"1588639953875541,test-aurora-master-instance,rdsadmin,localhost,4,8020,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854824240839223220777626911208894821209476553637892","timestamp":1588639953905,"message":"1588639953905514,test-aurora-master-instance,rdsadmin,localhost,4,8021,QUERY,mysql,'COMMIT',0"},{"id":"35427854824820658598382573828591137569910066875709128709","timestamp":1588639953931,"message":"1588639953931643,test-aurora-master-instance,rdsadmin,localhost,4,8022,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427854827496748022206248605575423762627870256426778630","timestamp":1588639954051,"message":"1588639954051774,test-aurora-master-instance,rdsadmin,localhost,2,8023,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854827519048767404779228716959480900518617932759047","timestamp":1588639954052,"message":"1588639954052270,test-aurora-master-instance,rdsadmin,localhost,2,8024,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427854827541349512603309851858495199173166979438739464","timestamp":1588639954053,"message":"1588639954053184,test-aurora-master-instance,rdsadmin,localhost,2,8025,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854865809428273281859165136144086560733374269751296","timestamp":1588639955769,"message":"1588639955769078,test-aurora-master-instance,rdsadmin,localhost,4,8028,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639955716) ON DUPLICATE KEY UPDATE value = 1588639955716',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854864605188032561205515448128763357025250155495424","timestamp":1588639955715,"message":"1588639955715919,test-aurora-master-instance,rdsadmin,localhost,4,8026,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427854865073503681730348601420378847082640841781084161","timestamp":1588639955736,"message":"1588639955736910,test-aurora-master-instance,rdsadmin,localhost,4,8027,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854865675623802090675426241843240444146602442555394","timestamp":1588639955763,"message":"1588639955763121,test-aurora-master-instance,rdsadmin,localhost,4,8028,WRITE,mysql,rds_heartbeat2,"},{"id":"35427854866746059571620145337035557717531267954729615363","timestamp":1588639955811,"message":"1588639955811621,test-aurora-master-instance,rdsadmin,localhost,4,8029,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854867258976711186349669290879237802180269367164932","timestamp":1588639955834,"message":"1588639955834350,test-aurora-master-instance,rdsadmin,localhost,4,8030,QUERY,mysql,'COMMIT',0"},{"id":"35427854867325878946781941538715486392620125353885106181","timestamp":1588639955837,"message":"1588639955837634,test-aurora-master-instance,rdsadmin,localhost,4,8031,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427854871763727241289535543881094328877149293575208966","timestamp":1588639956036,"message":"1588639956036401,test-aurora-master-instance,rdsadmin,localhost,2,8032,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854871763727241289535543881094328877149293575208967","timestamp":1588639956036,"message":"1588639956036806,test-aurora-master-instance,rdsadmin,localhost,2,8033,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427854871786027986488066167022630047149797655081189384","timestamp":1588639956037,"message":"1588639956037173,test-aurora-master-instance,rdsadmin,localhost,2,8034,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854910410918670343105450576496388400783843509272576","timestamp":1588639957769,"message":"1588639957769623,test-aurora-master-instance,rdsadmin,localhost,4,8035,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427854913064707348968249604419246862845938862720942081","timestamp":1588639957888,"message":"1588639957888234,test-aurora-master-instance,rdsadmin,localhost,4,8040,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427854917524856388674374232726390517375611163917025282","timestamp":1588639958088,"message":"1588639958088152,test-aurora-master-instance,rdsadmin,localhost,2,8042,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854910723129103122534174606735767213465762750267392","timestamp":1588639957783,"message":"1588639957783043,test-aurora-master-instance,rdsadmin,localhost,4,8036,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854911169144007093146637437450132666432992869875713","timestamp":1588639957803,"message":"1588639957803166,test-aurora-master-instance,rdsadmin,localhost,4,8037,WRITE,mysql,rds_heartbeat2,"},{"id":"35427854911258346987887269130003593005757026438893797378","timestamp":1588639957807,"message":"1588639957807243,test-aurora-master-instance,rdsadmin,localhost,4,8037,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639957769) ON DUPLICATE KEY UPDATE value = 1588639957769',0"},{"id":"35427854911436752949475514115135878751938213330941640707","timestamp":1588639957815,"message":"1588639957815405,test-aurora-master-instance,rdsadmin,localhost,4,8038,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854912975504368174127111901843312750950274854289412","timestamp":1588639957884,"message":"1588639957884116,test-aurora-master-instance,rdsadmin,localhost,4,8039,QUERY,mysql,'COMMIT',0"},{"id":"35427854917502555643475843609633594122098567660568313861","timestamp":1588639958087,"message":"1588639958087707,test-aurora-master-instance,rdsadmin,localhost,2,8041,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854917524856388674374232775129840371216022074294278","timestamp":1588639958088,"message":"1588639958088721,test-aurora-master-instance,rdsadmin,localhost,2,8043,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854956194348562926474762798201139564785678064484352","timestamp":1588639959822,"message":"1588639959822812,test-aurora-master-instance,rdsadmin,localhost,4,8047,QUERY,mysql,'select @@session.tx_read_only',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854955748333658955862299923063680939839908610310144","timestamp":1588639959802,"message":"1588639959802125,test-aurora-master-instance,rdsadmin,localhost,4,8046,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639959752) ON DUPLICATE KEY UPDATE value = 1588639959752',0"},{"id":"35427854956930273154477985326424456749390203068427272193","timestamp":1588639959855,"message":"1588639959855779,test-aurora-master-instance,rdsadmin,localhost,4,8048,QUERY,mysql,'COMMIT',0"},{"id":"35427854957554694020036842774387456861024357190594723842","timestamp":1588639959883,"message":"1588639959883275,test-aurora-master-instance,rdsadmin,localhost,4,8049,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854954633296399029331142801136887588230803357237248","timestamp":1588639959752,"message":"1588639959752522,test-aurora-master-instance,rdsadmin,localhost,4,8044,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427854955280018009786719213905672717495033287030669313","timestamp":1588639959781,"message":"1588639959781877,test-aurora-master-instance,rdsadmin,localhost,4,8045,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427854955458423971374964199037958463676220179078512642","timestamp":1588639959789,"message":"1588639959789391,test-aurora-master-instance,rdsadmin,localhost,4,8046,WRITE,mysql,rds_heartbeat2,"},{"id":"35427854960699099093029660637298852257748585132983910403","timestamp":1588639960024,"message":"1588639960024679,test-aurora-master-instance,rdsadmin,localhost,2,8050,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427854960721399838228191260440387976021233494489890820","timestamp":1588639960025,"message":"1588639960025184,test-aurora-master-instance,rdsadmin,localhost,2,8051,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427854960721399838228191260440387976021233494489890821","timestamp":1588639960025,"message":"1588639960025615,test-aurora-master-instance,rdsadmin,localhost,2,8052,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855001843973984318660335874620946776382101064253440","timestamp":1588639961869,"message":"1588639961869098,test-aurora-master-instance,rdsadmin,localhost,4,8058,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854998699568911325842472959412407942170133396848640","timestamp":1588639961728,"message":"1588639961728988,test-aurora-master-instance,rdsadmin,localhost,4,8053,QUERY,mysql,'SET @@sql_log_bin=off',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854999569297974068536775313377583818297336372789248","timestamp":1588639961767,"message":"1588639961767561,test-aurora-master-instance,rdsadmin,localhost,4,8054,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855005501296196877682530961878644342761496963579905","timestamp":1588639962033,"message":"1588639962033024,test-aurora-master-instance,rdsadmin,localhost,2,8060,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855005501296196877682530961878644342761496963579906","timestamp":1588639962033,"message":"1588639962033736,test-aurora-master-instance,rdsadmin,localhost,2,8061,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427854999613899464465598021556373683817972245122711552","timestamp":1588639961769,"message":"1588639961769248,test-aurora-master-instance,rdsadmin,localhost,4,8055,WRITE,mysql,rds_heartbeat2,"},{"id":"35427854999903809152046496122396338021362400944700456961","timestamp":1588639961782,"message":"1588639961782561,test-aurora-master-instance,rdsadmin,localhost,4,8055,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639961729) ON DUPLICATE KEY UPDATE value = 1588639961729',0"},{"id":"35427855000327523310818577962085516668542719813314084866","timestamp":1588639961801,"message":"1588639961801022,test-aurora-master-instance,rdsadmin,localhost,4,8056,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855000974244921575966033190052498449522296987516931","timestamp":1588639961830,"message":"1588639961830463,test-aurora-master-instance,rdsadmin,localhost,4,8057,QUERY,mysql,'COMMIT',0"},{"id":"35427855005478995451679151907780267589524491321195560964","timestamp":1588639962032,"message":"1588639962032357,test-aurora-master-instance,rdsadmin,localhost,2,8059,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855043256457817990027511960850579384486266210615296","timestamp":1588639963726,"message":"1588639963726415,test-aurora-master-instance,rdsadmin,localhost,4,8062,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855043992382409541538075631529282381882195907969025","timestamp":1588639963759,"message":"1588639963759549,test-aurora-master-instance,rdsadmin,localhost,4,8063,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855044304592842320966799613029338198959256991694850","timestamp":1588639963773,"message":"1588639963773973,test-aurora-master-instance,rdsadmin,localhost,4,8064,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855044460698058710681161603779366107497787533557763","timestamp":1588639963780,"message":"1588639963780150,test-aurora-master-instance,rdsadmin,localhost,4,8064,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639963726) ON DUPLICATE KEY UPDATE value = 1588639963726',0"},{"id":"35427855044706006255894518016160672267106629764099342340","timestamp":1588639963791,"message":"1588639963791273,test-aurora-master-instance,rdsadmin,localhost,4,8065,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855045531133828240151072397493843194619139820617733","timestamp":1588639963828,"message":"1588639963828708,test-aurora-master-instance,rdsadmin,localhost,4,8066,QUERY,mysql,'COMMIT',0"},{"id":"35427855046244757674593131012926636827919366708011991046","timestamp":1588639963860,"message":"1588639963860596,test-aurora-master-instance,rdsadmin,localhost,4,8067,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427855050058185103541867570129244652542236525534642183","timestamp":1588639964031,"message":"1588639964031479,test-aurora-master-instance,rdsadmin,localhost,2,8068,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855050080485848740398193270780370814884887040622600","timestamp":1588639964032,"message":"1588639964032156,test-aurora-master-instance,rdsadmin,localhost,2,8069,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855050080485848740398193270780370814884887040622601","timestamp":1588639964032,"message":"1588639964032550,test-aurora-master-instance,rdsadmin,localhost,2,8070,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855073830779485175511840252899057933922249751789568","timestamp":1588639965097,"message":"1588639965097085,test-aurora-master-instance,rdsadmin,localhost,2,8072,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855073853080230374042463394434776206570611257769985","timestamp":1588639965098,"message":"1588639965098004,test-aurora-master-instance,rdsadmin,localhost,2,8074,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855073050253403226940030342695265104360502710566912","timestamp":1588639965062,"message":"1588639965062967,test-aurora-master-instance,rdsadmin,localhost,76,8071,QUERY,,'SELECT @@aurora_version',0"},{"id":"35427855087768745234257151303756269325052279096657641473","timestamp":1588639965722,"message":"1588639965722181,test-aurora-master-instance,rdsadmin,localhost,4,8075,QUERY,mysql,'SET @@sql_log_bin=off',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855089062188455771927447105190337819276194993995776","timestamp":1588639965780,"message":"1588639965780885,test-aurora-master-instance,rdsadmin,localhost,4,8077,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855089575105595338131779360511858090188509631545345","timestamp":1588639965803,"message":"1588639965803455,test-aurora-master-instance,rdsadmin,localhost,4,8078,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855090690142855264662936437297771722606584930566146","timestamp":1588639965853,"message":"1588639965853309,test-aurora-master-instance,rdsadmin,localhost,4,8080,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427855095239494875764910057310584299342872332150571011","timestamp":1588639966057,"message":"1588639966057961,test-aurora-master-instance,rdsadmin,localhost,2,8082,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855095261795620963440680452120017615520693656551428","timestamp":1588639966058,"message":"1588639966058861,test-aurora-master-instance,rdsadmin,localhost,2,8083,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855073830779485175511840212045561862519040108396544","timestamp":1588639965097,"message":"1588639965097942,test-aurora-master-instance,rdsadmin,localhost,2,8073,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855088415466845014539376053941113719556174936801280","timestamp":1588639965751,"message":"1588639965751867,test-aurora-master-instance,rdsadmin,localhost,4,8076,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855089352098143352825547998441281170787358187978753","timestamp":1588639965793,"message":"1588639965793096,test-aurora-master-instance,rdsadmin,localhost,4,8077,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639965722) ON DUPLICATE KEY UPDATE value = 1588639965722',0"},{"id":"35427855090400233167683764835650620039985260348969058306","timestamp":1588639965840,"message":"1588639965840307,test-aurora-master-instance,rdsadmin,localhost,4,8079,QUERY,mysql,'COMMIT',0"},{"id":"35427855095239494875764910057363870905149954795766808579","timestamp":1588639966057,"message":"1588639966057463,test-aurora-master-instance,rdsadmin,localhost,2,8081,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855132414837121715458836767958217050682978420785152","timestamp":1588639967724,"message":"1588639967724001,test-aurora-master-instance,rdsadmin,localhost,4,8084,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855132927754261281663169023279737321595293058334721","timestamp":1588639967747,"message":"1588639967747154,test-aurora-master-instance,rdsadmin,localhost,4,8086,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855133217663948862561269863244074866023992636080130","timestamp":1588639967760,"message":"1588639967760782,test-aurora-master-instance,rdsadmin,localhost,4,8087,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855134890219838752358005478422945314651105584611331","timestamp":1588639967835,"message":"1588639967835903,test-aurora-master-instance,rdsadmin,localhost,4,8089,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855134667212386767051774013072346718392364810371072","timestamp":1588639967825,"message":"1588639967825267,test-aurora-master-instance,rdsadmin,localhost,4,8088,QUERY,mysql,'COMMIT',0"},{"id":"35427855140086293470009993197406251886971944210763612161","timestamp":1588639968068,"message":"1588639968068707,test-aurora-master-instance,rdsadmin,localhost,2,8091,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855132637844573700765068092671010279643255542579200","timestamp":1588639967734,"message":"1588639967734912,test-aurora-master-instance,rdsadmin,localhost,4,8085,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855133039257987274316284640313939187313762650226689","timestamp":1588639967752,"message":"1588639967752428,test-aurora-master-instance,rdsadmin,localhost,4,8086,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639967724) ON DUPLICATE KEY UPDATE value = 1588639967724',0"},{"id":"35427855140041691979612931951082529476798899275528077314","timestamp":1588639968066,"message":"1588639968066084,test-aurora-master-instance,rdsadmin,localhost,2,8090,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855140130894960407054443648672349889492721551998979","timestamp":1588639968070,"message":"1588639968070595,test-aurora-master-instance,rdsadmin,localhost,2,8092,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855177038628263975235745345332258551869087078219776","timestamp":1588639969725,"message":"1588639969725450,test-aurora-master-instance,rdsadmin,localhost,4,8093,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855183840355549527075803513726331709619346402246657","timestamp":1588639970030,"message":"1588639970030075,test-aurora-master-instance,rdsadmin,localhost,2,8099,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855183840355549527075803513726331709619346402246658","timestamp":1588639970030,"message":"1588639970030588,test-aurora-master-instance,rdsadmin,localhost,2,8100,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855183840355549527075803513726331709619346402246659","timestamp":1588639970030,"message":"1588639970030644,test-aurora-master-instance,rdsadmin,localhost,2,8101,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855180762852712129849809933270676679475273017196544","timestamp":1588639969892,"message":"1588639969892732,test-aurora-master-instance,rdsadmin,localhost,4,8096,QUERY,mysql,'select @@session.tx_read_only',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855178532778192276787495959893727802415013579849728","timestamp":1588639969792,"message":"1588639969792150,test-aurora-master-instance,rdsadmin,localhost,4,8094,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855181253469106497523519227251357065515117309460481","timestamp":1588639969914,"message":"1588639969914446,test-aurora-master-instance,rdsadmin,localhost,4,8097,QUERY,mysql,'COMMIT',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855178978793096247399958737496777015286325892218880","timestamp":1588639969812,"message":"1588639969812900,test-aurora-master-instance,rdsadmin,localhost,4,8095,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855179536311726210665537275889733831495363541729281","timestamp":1588639969837,"message":"1588639969837768,test-aurora-master-instance,rdsadmin,localhost,4,8095,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639969725) ON DUPLICATE KEY UPDATE value = 1588639969725',0"},{"id":"35427855181565679539276952243155640096642496260585947138","timestamp":1588639969928,"message":"1588639969928544,test-aurora-master-instance,rdsadmin,localhost,4,8098,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855222286840271793870101980020087829123538131812352","timestamp":1588639971754,"message":"1588639971754534,test-aurora-master-instance,rdsadmin,localhost,4,8102,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855223446479022117462505339877438006838336442793985","timestamp":1588639971806,"message":"1588639971806270,test-aurora-master-instance,rdsadmin,localhost,4,8103,QUERY,mysql,'select @@session.tx_read_only',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855223780990200095421852417405634019824744020115456","timestamp":1588639971821,"message":"1588639971821346,test-aurora-master-instance,rdsadmin,localhost,4,8104,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639971754) ON DUPLICATE KEY UPDATE value = 1588639971754',0"},{"id":"35427855228843259360161873305546013681911002805877669889","timestamp":1588639972048,"message":"1588639972048812,test-aurora-master-instance,rdsadmin,localhost,2,8108,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855228865560105360403928687549400183651167383650306","timestamp":1588639972049,"message":"1588639972049391,test-aurora-master-instance,rdsadmin,localhost,2,8110,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855223535682002911584997813392518409337735447838720","timestamp":1588639971810,"message":"1588639971810984,test-aurora-master-instance,rdsadmin,localhost,4,8104,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855224539215536845463039182499840678514003216957441","timestamp":1588639971855,"message":"1588639971855687,test-aurora-master-instance,rdsadmin,localhost,4,8105,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855224896027460021953009447071333040887787312644098","timestamp":1588639971871,"message":"1588639971871246,test-aurora-master-instance,rdsadmin,localhost,4,8106,QUERY,mysql,'COMMIT',0"},{"id":"35427855225721155032367586065683892909128877163033919491","timestamp":1588639971908,"message":"1588639971908307,test-aurora-master-instance,rdsadmin,localhost,4,8107,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427855228865560105360403928640429185572296135377158148","timestamp":1588639972049,"message":"1588639972049313,test-aurora-master-instance,rdsadmin,localhost,2,8109,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855268248676125965484399088477889597031442532597760","timestamp":1588639973815,"message":"1588639973815571,test-aurora-master-instance,rdsadmin,localhost,4,8115,QUERY,mysql,'COMMIT',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855265996300860913891461833592896320204371391676416","timestamp":1588639973714,"message":"1588639973714461,test-aurora-master-instance,rdsadmin,localhost,4,8111,QUERY,mysql,'SET @@sql_log_bin=off',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855266330812038891850808879033421015008991117049856","timestamp":1588639973729,"message":"1588639973729031,test-aurora-master-instance,rdsadmin,localhost,4,8112,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855267289744082428667603965069306738888535874207745","timestamp":1588639973772,"message":"1588639973772961,test-aurora-master-instance,rdsadmin,localhost,4,8113,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855268047969419178708790777283728008932827077541890","timestamp":1588639973806,"message":"1588639973806331,test-aurora-master-instance,rdsadmin,localhost,4,8113,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639973714) ON DUPLICATE KEY UPDATE value = 1588639973714',0"},{"id":"35427855268181773890369892529626498037644822996113424387","timestamp":1588639973812,"message":"1588639973812971,test-aurora-master-instance,rdsadmin,localhost,4,8114,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855273154840069642221490188963212445407611947057156","timestamp":1588639974035,"message":"1588639974035523,test-aurora-master-instance,rdsadmin,localhost,2,8118,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855273177140814840752113330498930718055973453037573","timestamp":1588639974036,"message":"1588639974036162,test-aurora-master-instance,rdsadmin,localhost,2,8119,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855268605488049141974369269928130517453171333332992","timestamp":1588639973831,"message":"1588639973831028,test-aurora-master-instance,rdsadmin,localhost,4,8116,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427855273154840069642221490143214658137718918553337857","timestamp":1588639974035,"message":"1588639974035034,test-aurora-master-instance,rdsadmin,localhost,2,8117,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855311935835969886975135686710434531697675877613568","timestamp":1588639975774,"message":"1588639975774210,test-aurora-master-instance,rdsadmin,localhost,4,8121,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855312381850873857587598517424799984664905997221889","timestamp":1588639975794,"message":"1588639975794167,test-aurora-master-instance,rdsadmin,localhost,4,8122,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639975748) ON DUPLICATE KEY UPDATE value = 1588639975748',0"},{"id":"35427855313942903037754731218424925079070050211415851010","timestamp":1588639975864,"message":"1588639975864032,test-aurora-master-instance,rdsadmin,localhost,4,8124,QUERY,mysql,'COMMIT',0"},{"id":"35427855317488721524321100297929104284421139690866737155","timestamp":1588639976023,"message":"1588639976023026,test-aurora-master-instance,rdsadmin,localhost,2,8128,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855312270347147864934482904097390374207539308855296","timestamp":1588639975789,"message":"1588639975789393,test-aurora-master-instance,rdsadmin,localhost,4,8122,WRITE,mysql,rds_heartbeat2,"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855311356016594725178934149782405365751897299025920","timestamp":1588639975748,"message":"1588639975748479,test-aurora-master-instance,rdsadmin,localhost,4,8120,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855314188211234938568073124818625992093808558538753","timestamp":1588639975875,"message":"1588639975875809,test-aurora-master-instance,rdsadmin,localhost,4,8125,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855312961670249019383800247966619186988164703387648","timestamp":1588639975820,"message":"1588639975820529,test-aurora-master-instance,rdsadmin,localhost,4,8123,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855317466420779122569674838181710261957188911431681","timestamp":1588639976022,"message":"1588639976022324,test-aurora-master-instance,rdsadmin,localhost,2,8126,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855317466420779122569674838181710261957188911431682","timestamp":1588639976022,"message":"1588639976022782,test-aurora-master-instance,rdsadmin,localhost,2,8127,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855357563160646080630085738609514992436272061808640","timestamp":1588639977820,"message":"1588639977820294,test-aurora-master-instance,rdsadmin,localhost,4,8131,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855359057310574382181836221502639259876492962496513","timestamp":1588639977887,"message":"1588639977887983,test-aurora-master-instance,rdsadmin,localhost,4,8133,QUERY,mysql,'COMMIT',0"},{"id":"35427855363628963340080959580236324885152790601688481794","timestamp":1588639978092,"message":"1588639978092622,test-aurora-master-instance,rdsadmin,localhost,2,8136,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855363628963340080959580236324885152790601688481795","timestamp":1588639978092,"message":"1588639978092916,test-aurora-master-instance,rdsadmin,localhost,2,8137,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855355578394323411404626176974453200799840989806592","timestamp":1588639977731,"message":"1588639977731984,test-aurora-master-instance,rdsadmin,localhost,4,8129,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855356804935309330588898961438958196459723818729473","timestamp":1588639977786,"message":"1588639977786507,test-aurora-master-instance,rdsadmin,localhost,4,8130,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855357853070333661528186613617717010932714599809026","timestamp":1588639977833,"message":"1588639977833149,test-aurora-master-instance,rdsadmin,localhost,4,8132,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855363606662594882428957129833031354209983142756355","timestamp":1588639978091,"message":"1588639978091987,test-aurora-master-instance,rdsadmin,localhost,2,8135,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855359882438146727814892408752416045387927497932800","timestamp":1588639977924,"message":"1588639977924475,test-aurora-master-instance,rdsadmin,localhost,4,8134,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855357630062881676221955238526912615019540444610560","timestamp":1588639977823,"message":"1588639977823403,test-aurora-master-instance,rdsadmin,localhost,4,8131,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639977732) ON DUPLICATE KEY UPDATE value = 1588639977732',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855404327823327399346815953552830389651157125431296","timestamp":1588639979917,"message":"1588639979917819,test-aurora-master-instance,rdsadmin,localhost,4,8143,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427855407048514241620082839220910459652751260855042049","timestamp":1588639980039,"message":"1588639980039172,test-aurora-master-instance,rdsadmin,localhost,76,8144,READ,mysql,rds_history,"},{"id":"35427855407048514241620082839220910459652751260855042050","timestamp":1588639980039,"message":"1588639980039281,test-aurora-master-instance,rdsadmin,localhost,76,8144,QUERY,mysql,'SELECT count(*) from mysql.rds_history WHERE action = \\'disable set master\\' ORDER BY action_timestamp LIMIT 1',0"},{"id":"35427855407427626909995103432627017670287773406456709123","timestamp":1588639980056,"message":"1588639980056521,test-aurora-master-instance,rdsadmin,localhost,76,8145,QUERY,mysql,'SELECT count(*) from mysql.rds_replication_status WHERE master_host IS NOT NULL and master_port IS NOT NULL ORDER BY action_timestamp LIMIT 1',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855400625899624443263374415073279110484798233640960","timestamp":1588639979751,"message":"1588639979751326,test-aurora-master-instance,rdsadmin,localhost,4,8138,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855403948710659024326222503895301735090662624722945","timestamp":1588639979900,"message":"1588639979900358,test-aurora-master-instance,rdsadmin,localhost,4,8142,QUERY,mysql,'COMMIT',0"},{"id":"35427855410973445396561472512087646557619324537008553986","timestamp":1588639980215,"message":"1588639980215882,test-aurora-master-instance,rdsadmin,localhost,2,8150,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855411018046886958533758370717994164621260020514819","timestamp":1588639980217,"message":"1588639980217968,test-aurora-master-instance,rdsadmin,localhost,2,8152,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855401696335393972733285293479078635299662652899328","timestamp":1588639979799,"message":"1588639979799619,test-aurora-master-instance,rdsadmin,localhost,4,8139,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855401874741355560978270425764824816486554700742657","timestamp":1588639979807,"message":"1588639979807754,test-aurora-master-instance,rdsadmin,localhost,4,8140,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855402186951788340406994407264880633563615784468482","timestamp":1588639979821,"message":"1588639979821330,test-aurora-master-instance,rdsadmin,localhost,4,8140,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639979751) ON DUPLICATE KEY UPDATE value = 1588639979751',0"},{"id":"35427855402878274889494856311794872147085662822469861379","timestamp":1588639979852,"message":"1588639979852499,test-aurora-master-instance,rdsadmin,localhost,4,8141,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855407427626909995103432668158674705928569689866244","timestamp":1588639980056,"message":"1588639980056413,test-aurora-master-instance,rdsadmin,localhost,76,8145,READ,mysql,rds_replication_status,"},{"id":"35427855408564964915120165212886480306610995006494867461","timestamp":1588639980107,"message":"1588639980107618,test-aurora-master-instance,rdsadmin,localhost,76,8146,QUERY,mysql,'SELECT @@aurora_version',0"},{"id":"35427855409702302920245226993104801938516061443299868678","timestamp":1588639980158,"message":"1588639980158948,test-aurora-master-instance,rdsadmin,localhost,2,8147,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855409724603665443757616246337656788709804805849095","timestamp":1588639980159,"message":"1588639980159719,test-aurora-master-instance,rdsadmin,localhost,2,8148,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855409724603665443757616246337656788709804805849096","timestamp":1588639980159,"message":"1588639980159780,test-aurora-master-instance,rdsadmin,localhost,2,8149,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"},{"id":"35427855411018046886958533758455409316602314772152713225","timestamp":1588639980217,"message":"1588639980217091,test-aurora-master-instance,rdsadmin,localhost,2,8151,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855445338893747497162775657950117979399375154511872","timestamp":1588639981756,"message":"1588639981756457,test-aurora-master-instance,rdsadmin,localhost,4,8153,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855446610036223813408294725486059520355980995395585","timestamp":1588639981813,"message":"1588639981813329,test-aurora-master-instance,rdsadmin,localhost,4,8155,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855446922246656592837018706986115337433042079121410","timestamp":1588639981827,"message":"1588639981827231,test-aurora-master-instance,rdsadmin,localhost,4,8156,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855447970381680923776306359164874151906032860200963","timestamp":1588639981874,"message":"1588639981874076,test-aurora-master-instance,rdsadmin,localhost,4,8158,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855446676938459409000164201016150821738710916399104","timestamp":1588639981816,"message":"1588639981816867,test-aurora-master-instance,rdsadmin,localhost,4,8155,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639981756) ON DUPLICATE KEY UPDATE value = 1588639981756',0"},{"id":"35427855447613569757747286336145516318272969894167576577","timestamp":1588639981858,"message":"1588639981858353,test-aurora-master-instance,rdsadmin,localhost,4,8157,QUERY,mysql,'COMMIT',0"},{"id":"35427855453679372451747615830643231688433324223794249730","timestamp":1588639982130,"message":"1588639982130342,test-aurora-master-instance,rdsadmin,localhost,2,8159,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855453679372451747615830643231688433324223794249731","timestamp":1588639982130,"message":"1588639982130821,test-aurora-master-instance,rdsadmin,localhost,2,8160,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855453701673196946146453784767406705972585300230148","timestamp":1588639982131,"message":"1588639982131734,test-aurora-master-instance,rdsadmin,localhost,2,8161,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855445651104180276591499731188624950228155968520192","timestamp":1588639981770,"message":"1588639981770176,test-aurora-master-instance,rdsadmin,localhost,4,8154,QUERY,mysql,'select @@session.tx_read_only',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855489382865514595143482677586734040242601293578240","timestamp":1588639983731,"message":"1588639983731961,test-aurora-master-instance,rdsadmin,localhost,4,8162,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855489628173711778980337234479635039374577859362817","timestamp":1588639983742,"message":"1588639983742369,test-aurora-master-instance,rdsadmin,localhost,4,8163,QUERY,mysql,'select @@session.tx_read_only',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855493731510828308614995323296379218556519603240960","timestamp":1588639983926,"message":"1588639983926326,test-aurora-master-instance,rdsadmin,localhost,4,8167,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855491077722149683470841389415923842652333076447232","timestamp":1588639983807,"message":"1588639983807362,test-aurora-master-instance,rdsadmin,localhost,4,8164,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855491256128111271715826521701670023839225124290561","timestamp":1588639983815,"message":"1588639983815450,test-aurora-master-instance,rdsadmin,localhost,4,8164,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639983732) ON DUPLICATE KEY UPDATE value = 1588639983732',0"},{"id":"35427855491880548976830573274484701781657993347291742210","timestamp":1588639983843,"message":"1588639983843023,test-aurora-master-instance,rdsadmin,localhost,4,8165,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855492036654193220287636475451809566531877833605123","timestamp":1588639983850,"message":"1588639983850338,test-aurora-master-instance,rdsadmin,localhost,4,8166,QUERY,mysql,'COMMIT',0"},{"id":"35427855496385299506933759149074916872732962371499786244","timestamp":1588639984045,"message":"1588639984045844,test-aurora-master-instance,rdsadmin,localhost,2,8168,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855496407600252132289772216452591005610733005766661","timestamp":1588639984046,"message":"1588639984046370,test-aurora-master-instance,rdsadmin,localhost,2,8169,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855496407600252132289772216452591005610733005766662","timestamp":1588639984046,"message":"1588639984046811,test-aurora-master-instance,rdsadmin,localhost,2,8170,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855535612310311149125257390418636240532190838128640","timestamp":1588639985804,"message":"1588639985804547,test-aurora-master-instance,rdsadmin,localhost,4,8172,QUERY,mysql,'select @@session.tx_read_only',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855535902219998730023358363444626652487564662079488","timestamp":1588639985817,"message":"1588639985817251,test-aurora-master-instance,rdsadmin,localhost,4,8173,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855536036024469921207097212658936288377733697961985","timestamp":1588639985823,"message":"1588639985823417,test-aurora-master-instance,rdsadmin,localhost,4,8173,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639985717) ON DUPLICATE KEY UPDATE value = 1588639985717',0"},{"id":"35427855536281332667105043951769551837287509710263746562","timestamp":1588639985834,"message":"1588639985834424,test-aurora-master-instance,rdsadmin,localhost,4,8174,QUERY,mysql,'select @@session.tx_read_only',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855533672145478876961044120395559337814863965716480","timestamp":1588639985717,"message":"1588639985717695,test-aurora-master-instance,rdsadmin,localhost,4,8171,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855538266098989774269411276753523503377334197682177","timestamp":1588639985923,"message":"1588639985923764,test-aurora-master-instance,rdsadmin,localhost,4,8176,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427855540451572019230270479147253914222916761783762946","timestamp":1588639986021,"message":"1588639986021646,test-aurora-master-instance,rdsadmin,localhost,2,8178,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855538199196754178677541900204430483822147229188096","timestamp":1588639985920,"message":"1588639985920335,test-aurora-master-instance,rdsadmin,localhost,4,8175,QUERY,mysql,'COMMIT',0"},{"id":"35427855540451572019230270479195311976021306659333210113","timestamp":1588639986021,"message":"1588639986021025,test-aurora-master-instance,rdsadmin,localhost,2,8177,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855540451572019230270479195311976021306659333210114","timestamp":1588639986021,"message":"1588639986021801,test-aurora-master-instance,rdsadmin,localhost,2,8179,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855579344071645467677240396173934255320093878190080","timestamp":1588639987765,"message":"1588639987765117,test-aurora-master-instance,rdsadmin,localhost,4,8180,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855579968492511026534688359174045889474216045641729","timestamp":1588639987793,"message":"1588639987793925,test-aurora-master-instance,rdsadmin,localhost,4,8181,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855580414507414997147151189888411342441446165250050","timestamp":1588639987813,"message":"1588639987813222,test-aurora-master-instance,rdsadmin,localhost,4,8182,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855586101197440622456052281496570867773630190256131","timestamp":1588639988068,"message":"1588639988068072,test-aurora-master-instance,rdsadmin,localhost,2,8186,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855586123498185820986675423032289140421991696236548","timestamp":1588639988069,"message":"1588639988069699,test-aurora-master-instance,rdsadmin,localhost,2,8188,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855580659815612180984005706593325433804394927161344","timestamp":1588639987824,"message":"1588639987824219,test-aurora-master-instance,rdsadmin,localhost,4,8182,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639987765) ON DUPLICATE KEY UPDATE value = 1588639987765',0"},{"id":"35427855586101197440622456052241308583960004602386382849","timestamp":1588639988068,"message":"1588639988068788,test-aurora-master-instance,rdsadmin,localhost,2,8187,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855581596446910519270177731857317612768495186477056","timestamp":1588639987866,"message":"1588639987866307,test-aurora-master-instance,rdsadmin,localhost,4,8183,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855582666882680048740088525571794699889847473537025","timestamp":1588639987914,"message":"1588639987914855,test-aurora-master-instance,rdsadmin,localhost,4,8185,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855582243168521276658248886129358731620109237157888","timestamp":1588639987895,"message":"1588639987895224,test-aurora-master-instance,rdsadmin,localhost,4,8184,QUERY,mysql,'COMMIT',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855624703787379278964712651299338213129431788027904","timestamp":1588639989799,"message":"1588639989799107,test-aurora-master-instance,rdsadmin,localhost,4,8190,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855625149802283249577175482013703666096661907636225","timestamp":1588639989819,"message":"1588639989819187,test-aurora-master-instance,rdsadmin,localhost,4,8191,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639989742) ON DUPLICATE KEY UPDATE value = 1588639989742',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855623432644902962719193691412660722711054433452032","timestamp":1588639989742,"message":"1588639989742622,test-aurora-master-instance,rdsadmin,localhost,4,8189,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855625685020168014312130986520206260195566537474049","timestamp":1588639989843,"message":"1588639989843798,test-aurora-master-instance,rdsadmin,localhost,4,8192,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855626956162644330557650054056147801152172378357762","timestamp":1588639989900,"message":"1588639989900405,test-aurora-master-instance,rdsadmin,localhost,4,8193,QUERY,mysql,'COMMIT',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.3.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855627268373077109986373968260486271840949933572096","timestamp":1588639989914,"message":"1588639989914440,test-aurora-master-instance,rdsadmin,localhost,4,8194,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427855629543049087360109934404903750081973823543574529","timestamp":1588639990016,"message":"1588639990016441,test-aurora-master-instance,rdsadmin,localhost,2,8195,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855629565349832558640557546439468354622185049554946","timestamp":1588639990017,"message":"1588639990017507,test-aurora-master-instance,rdsadmin,localhost,2,8196,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855629565349832558640557546439468354622185049554947","timestamp":1588639990017,"message":"1588639990017883,test-aurora-master-instance,rdsadmin,localhost,2,8197,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855624703787379278964712731386977076213964786171904","timestamp":1588639989799,"message":"1588639989799692,test-aurora-master-instance,rdsadmin,localhost,4,8191,WRITE,mysql,rds_heartbeat2,"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855668346345732803394203052586554896135929793544192","timestamp":1588639991756,"message":"1588639991756971,test-aurora-master-instance,rdsadmin,localhost,4,8198,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855669349879266737272244421693877165312197562662913","timestamp":1588639991801,"message":"1588639991801217,test-aurora-master-instance,rdsadmin,localhost,4,8199,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855669929698641899068446101622552254169596718153730","timestamp":1588639991827,"message":"1588639991827322,test-aurora-master-instance,rdsadmin,localhost,4,8200,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855669996600877494660315526229707072114681236094979","timestamp":1588639991830,"message":"1588639991830652,test-aurora-master-instance,rdsadmin,localhost,4,8200,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639991757) ON DUPLICATE KEY UPDATE value = 1588639991757',0"},{"id":"35427855670130405348685844054375444016708004850271977476","timestamp":1588639991836,"message":"1588639991836548,test-aurora-master-instance,rdsadmin,localhost,4,8201,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855671133938882619722095744551338977181118041096197","timestamp":1588639991881,"message":"1588639991881581,test-aurora-master-instance,rdsadmin,localhost,4,8202,QUERY,mysql,'COMMIT',0"},{"id":"35427855674635155878789029928965659107782973874480021510","timestamp":1588639992038,"message":"1588639992038727,test-aurora-master-instance,rdsadmin,localhost,2,8204,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855674657456623987560552107194826055622235986001927","timestamp":1588639992039,"message":"1588639992039380,test-aurora-master-instance,rdsadmin,localhost,2,8205,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855674657456623987560552107194826055622235986001928","timestamp":1588639992039,"message":"1588639992039804,test-aurora-master-instance,rdsadmin,localhost,2,8206,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.0","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855672048269435759477644589493335430837161705209856","timestamp":1588639991922,"message":"1588639991922521,test-aurora-master-instance,rdsadmin,localhost,4,8203,QUERY,mysql,'SET @@sql_log_bin=on',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.2.2020-05-05-00-29.0.3","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855712256513028710191171252170278455151841504722944","timestamp":1588639993725,"message":"1588639993725565,test-aurora-master-instance,rdsadmin,localhost,4,8207,QUERY,mysql,'SET @@sql_log_bin=off',0"},{"id":"35427855716069940457658927728454778103078021659027374081","timestamp":1588639993896,"message":"1588639993896845,test-aurora-master-instance,rdsadmin,localhost,4,8210,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855716850466539607499538408528242620714311736688642","timestamp":1588639993931,"message":"1588639993931151,test-aurora-master-instance,rdsadmin,localhost,4,8212,QUERY,mysql,'SET @@sql_log_bin=on',0"},{"id":"35427855719147443295056153721986707224703495546852671491","timestamp":1588639994034,"message":"1588639994034238,test-aurora-master-instance,rdsadmin,localhost,2,8214,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855715289414375710355918541723076883167140459708416","timestamp":1588639993861,"message":"1588639993861425,test-aurora-master-instance,rdsadmin,localhost,4,8209,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639993725) ON DUPLICATE KEY UPDATE value = 1588639993725',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.1","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855713839865937805865414256009779025841722875445248","timestamp":1588639993796,"message":"1588639993796091,test-aurora-master-instance,rdsadmin,localhost,4,8208,QUERY,mysql,'select @@session.tx_read_only',0"},{"id":"35427855714375083822570600369652867017569402399018975233","timestamp":1588639993820,"message":"1588639993820563,test-aurora-master-instance,rdsadmin,localhost,4,8209,WRITE,mysql,rds_heartbeat2,"},{"id":"35427855716649759832820723930089510281379535272628977666","timestamp":1588639993922,"message":"1588639993922569,test-aurora-master-instance,rdsadmin,localhost,4,8211,QUERY,mysql,'COMMIT',0"},{"id":"35427855719125142549857623098799975009643503399792803843","timestamp":1588639994033,"message":"1588639994033051,test-aurora-master-instance,rdsadmin,localhost,2,8213,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855719147443295056153721941510727916151761298784260","timestamp":1588639994034,"message":"1588639994034320,test-aurora-master-instance,rdsadmin,localhost,2,8215,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.1.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855741225181041601470633221365015235713192218984448","timestamp":1588639995024,"message":"1588639995024186,test-aurora-master-instance,rdsadmin,localhost,76,8216,QUERY,mysql,'SELECT @@aurora_version',0"},{"id":"35427855741961105633152981196892043718233109121916338177","timestamp":1588639995057,"message":"1588639995057039,test-aurora-master-instance,rdsadmin,localhost,2,8217,QUERY,mysql,'set local oscar_local_only_replica_host_status=1',0"},{"id":"35427855741961105633152981196892043718233109121916338178","timestamp":1588639995057,"message":"1588639995057615,test-aurora-master-instance,rdsadmin,localhost,2,8218,QUERY,mysql,'SELECT durable_lsn, current_read_point, server_id, last_update_timestamp FROM information_schema.replica_host_status',0"},{"id":"35427855741961105633152981196892043718233109121916338179","timestamp":1588639995057,"message":"1588639995057902,test-aurora-master-instance,rdsadmin,localhost,2,8219,QUERY,mysql,'set local oscar_local_only_replica_host_status=0',0"}]}{"messageType":"DATA_MESSAGE","owner":"XXXXXXXXXXXX","logGroup":"/aws/rds/cluster/test-aurora-cluster/audit","logStream":"test-aurora-master-instance.audit.log.0.2020-05-05-00-29.0.2","subscriptionFilters":["Destination"],"logEvents":[{"id":"35427855757973040685697968613812228469727616623083520000","timestamp":1588639995775,"message":"1588639995775738,test-aurora-master-instance,rdsadmin,localhost,4,8222,QUERY,mysql,'INSERT INTO mysql.rds_heartbeat2(id, value) values (1,1588639995738) ON DUPLICATE KEY UPDATE value = 1588639995738',0"}]}

おまけ

配信エラー確認

今回、配信ストリームの設定で、データ配信失敗時にCloudWatch Logsにロギングが行われるように設定しています。意図的に配信を失敗させ、CloudWatch Logsへの出力を確認してみました。配信エラーコード、メッセージなど詳細については以下を確認ください。

CloudWatch Logs を使用した Kinesis Data Firehose のモニタリング

S3アクセスエラー

Kinesis Data FirehoseのIAMロール（ここではTestFirehosetoS3Role）からS3出力の権限を削除し、配信エラーを発生させます。アクセスエラーを発生させる前に、配信エラーのログを確認します。エラー未発生のためログデータはありません。

$ aws logs get-log-events \
    --log-group-name ${FIREHOSE_CWL_ERROR_LOG_GROUP_NAME} \
    --log-stream-name "S3Delivery"
{
    "events": [],
    "nextForwardToken": "f/35428046779354684011543411040466012753628310680392171520",
    "nextBackwardToken": "b/35428046779354684011543411040466012753628310680392171520"
}

ポリシードキュメント作成

S3への権限をもたないポリシードキュメントを作成します。

cat <<EOF > ./${FIREHOSE_PERMISSIONS_DOCUMENT_NAME}
{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
          "logs:PutLogEvents"
      ],
      "Resource": [
          "arn:aws:logs:${AWS_REGION}:${ACCOUNT_ID}:log-group:${FIREHOSE_CWL_ERROR_LOG_GROUP_NAME}:log-stream:*"
      ]
    }
  ]
}
EOF

ポリシー更新

作成したドキュメント（権限）でIAMロールを更新します。

aws iam put-role-policy \
  --role-name ${FIREHOSE_ROLE_NAME} \
  --policy-name ${FIREHOSE_POLICY_NAME} \
  --policy-document file://./${FIREHOSE_PERMISSIONS_DOCUMENT_NAME}

しばらくすると、配信エラーが発生し、以下メッセージがCloudWatch Logsに出力されました。

$ aws logs get-log-events \
    --log-group-name ${FIREHOSE_CWL_ERROR_LOG_GROUP_NAME} \
    --log-stream-name "S3Delivery"

{
    "events": [
        {
            "timestamp": 1588641603190,
            "message": "{\"deliveryStreamARN\":\"arn:aws:firehose:ap-northeast-1:XXXXXXXXXXXX:deliverystream/test-delivery-stream\",\"destination\":\"arn:aws:s3:::test-cloudwatch-logs-20200505091255\",\"deliveryStreamVersionId\":1,\"message\":\"Access was denied. Ensure that the trust policy for the provided IAM role allows Firehose to assume the role, and the access policy allows access to the S3 bucket.\",\"errorCode\":\"S3.AccessDenied\"}",
            "ingestionTime": 1588641660690
        }
    ],
    "nextForwardToken": "f/35427891604525383981799567677032080896193759532454379520",
    "nextBackwardToken": "b/35427891604525383981799567677032080896193759532454379520"
}

検証後はポリシー設定を元に戻しました。

バケットが存在しない

配信先のS3バケット（ここではtest-cloudwatch-logs-20200505091255）を削除し、配信エラーを発生させます。

$ aws s3 rb s3://${S3_BUCKET_NAME} --force
delete: s3://test-cloudwatch-logs-20200505091255/test-aurora-cluster/audit/2020/05/05/00/test-delivery-stream-1-2020-05-05-00-52-17-e5d8e05b-ce35-4b9a-a329-409c661a9679
（省略）
delete: s3://test-cloudwatch-logs-20200505091255/test-aurora-cluster/audit/2020/05/05/00/test-delivery-stream-1-2020-05-05-00-58-25-f19f1a35-17e9-4198-ae05-030ce72f88ce
remove_bucket: test-cloudwatch-logs-20200505091255

しばらくすると、配信エラーが発生し、以下メッセージがCloudWatch Logsに出力されました。

$ aws logs get-log-events \
    --log-group-name ${FIREHOSE_CWL_ERROR_LOG_GROUP_NAME} \
    --log-stream-name "S3Delivery"
{
    "events": [
        {
            "timestamp": 1588641603190,
            "message": "{\"deliveryStreamARN\":\"arn:aws:firehose:ap-northeast-1:XXXXXXXXXXXX:deliverystream/test-delivery-stream\",\"destination\":\"arn:aws:s3:::test-cloudwatch-logs-20200505091255\",\"deliveryStreamVersionId\":1,\"message\":\"Access was denied. Ensure that the trust policy for the provided IAM role allows Firehose to assume the role, and the access policy allows access to the S3 bucket.\",\"errorCode\":\"S3.AccessDenied\"}",
            "ingestionTime": 1588641660690
        },
        {
            "timestamp": 1588642154635,
            "message": "{\"deliveryStreamARN\":\"arn:aws:firehose:ap-northeast-1:XXXXXXXXXXXX:deliverystream/test-delivery-stream\",\"destination\":\"arn:aws:s3:::test-cloudwatch-logs-20200505091255\",\"deliveryStreamVersionId\":1,\"message\":\"The specified bucket does not exist. Create the bucket or use a different bucket name that does exist.\",\"errorCode\":\"S3.NoSuchBucket\"}",
            "ingestionTime": 1588642170686
        }
    ],
    "nextForwardToken": "f/35427903902159819985519046577743521058352768762475773952",
    "nextBackwardToken": "b/35427891604525383981799567677032080896193759532454379520"
}

CFnテンプレート

今回、AWS CLIで構築した同様の構成を定義するCFnテンプレートを作成しました。

Gist/CloudWatchLogsToS3.yml

さいごに

CloudWatch Logsにログデータを保管すると、お手軽に内容を確認できますが、長期保存の際はコスト面が気になってくることかと思います。本エントリを参考にS3への出力などを検討していただければと思います。S3へ出力したいロググループに、既にサブスクリプションフィルタが設定されている場合、以下のような構成も検討できると思いますので、サブスクリプションフィルタが利用できない場合は参考にしてください。