dolfinus · Jun 14, 2025
diff --git a/fe/fe-core/src/main/java/org/apache/doris/catalog/InternalSchema.java b/fe/fe-core/src/main/java/org/apache/doris/catalog/InternalSchema.java
@@ -141,6 +141,8 @@ public class InternalSchema {
                 ScalarType.createVarchar(Config.label_regex_length), ColumnNullableType.NULLABLE));
         AUDIT_SCHEMA.add(new ColumnDef("time",
                 ScalarType.createDatetimeV2Type(3), ColumnNullableType.NULLABLE));
+        AUDIT_SCHEMA.add(new ColumnDef("session_id",
+                ScalarType.createVarchar(36), ColumnNullableType.NULLABLE));
         // cs info
         AUDIT_SCHEMA.add(new ColumnDef("client_ip",
                 ScalarType.createVarchar(128), ColumnNullableType.NULLABLE));

diff --git a/fe/fe-core/src/main/java/org/apache/doris/catalog/InternalSchemaInitializer.java b/fe/fe-core/src/main/java/org/apache/doris/catalog/InternalSchemaInitializer.java
@@ -343,6 +343,7 @@ public static void createTbl() throws UserException {
          *CREATE TABLE IF NOT EXISTS `internal`.`__internal_schema`.`audit_log` (
          *   `query_id` varchar(48) NULL COMMENT "",
          *   `time` datetimev2(3) NULL COMMENT "",
+         *   `session_id` varchar(36) NULL COMMENT "",
          *   `client_ip` varchar(128) NULL COMMENT "",
          *   `user` varchar(128) NULL COMMENT "",
          *   `frontend_ip` varchar(1024) NULL COMMENT "",
@@ -384,7 +385,7 @@ public static void createTbl() throws UserException {
          *   `compute_group` text NULL COMMENT "",
          *   `stmt` text NULL COMMENT ""
          * ) ENGINE = olap
-         * DUPLICATE KEY(`query_id`, `time`, `client_ip`)
+         * DUPLICATE KEY(`query_id`, `time`, `session_id`)
          * COMMENT "Doris internal audit table, DO NOT MODIFY IT"
          * PARTITION BY RANGE(`time`)
          * (
@@ -467,7 +468,7 @@ private static String getAuditLogCreateSql() throws UserException {
                 "CREATE TABLE IF NOT EXISTS `%s`.`%s`.`%s` (\n"
                         + "%s\n"
                         + ") ENGINE = olap\n"
-                        + "DUPLICATE KEY(`query_id`, `time`, `client_ip`)\n"
+                        + "DUPLICATE KEY(`query_id`, `time`, `session_id`)\n"
                         + "COMMENT \"Doris internal audit table, DO NOT MODIFY IT\"\n"
                         + "PARTITION BY RANGE(`time`)\n"
                         + "(\n"

diff --git a/fe/fe-core/src/main/java/org/apache/doris/plugin/AuditEvent.java b/fe/fe-core/src/main/java/org/apache/doris/plugin/AuditEvent.java
@@ -58,6 +58,8 @@ public enum EventType {
     public String queryId = "";
     @AuditField(value = "Timestamp", colName = "time")
     public long timestamp = -1;
+    @AuditField(value = "SessionId")
+    public String sessionId = "";
 
     // cs info
     @AuditField(value = "Client", colName = "client_ip")
@@ -186,6 +188,11 @@ public AuditEventBuilder setTimestamp(long timestamp) {
             return this;
         }
 
+        public AuditEventBuilder setSessionId(String sessionId) {
+            auditEvent.sessionId = sessionId;
+            return this;
+        }
+
         public AuditEventBuilder setClientIp(String clientIp) {
             auditEvent.clientIp = clientIp;
             return this;

diff --git a/fe/fe-core/src/main/java/org/apache/doris/plugin/audit/AuditLoader.java b/fe/fe-core/src/main/java/org/apache/doris/plugin/audit/AuditLoader.java
@@ -151,6 +151,7 @@ private void fillLogBuffer(AuditEvent event, StringBuilder logBuffer) {
         // uuid and time
         logBuffer.append(event.queryId).append(AUDIT_TABLE_COL_SEPARATOR);
         logBuffer.append(TimeUtils.longToTimeStringWithms(event.timestamp)).append(AUDIT_TABLE_COL_SEPARATOR);
+        logBuffer.append(event.sessionId).append(AUDIT_TABLE_COL_SEPARATOR);
 
         // cs info
         logBuffer.append(event.clientIp).append(AUDIT_TABLE_COL_SEPARATOR);

@@ -243,6 +243,7 @@ private static void logAuditLogImpl(ConnectContext ctx, String origStmt, Stateme
                 .setQueryId(ctx.queryId() == null ? "NaN" : DebugUtil.printId(ctx.queryId()))
                 .setTimestamp(ctx.getStartTime())
                 .setClientIp(ctx.getClientIP())
+                .setSessionId(ctx.getSessionId())
                 .setUser(ClusterNamespace.getNameFromFullName(ctx.getQualifiedUser()))
                 .setFeIp(FrontendOptions.getLocalHostAddress())
                 .setCtl(catalog == null ? InternalCatalog.INTERNAL_CATALOG_NAME : catalog.getName())

diff --git a/fe/fe-core/src/test/java/org/apache/doris/qe/AuditEventProcessorTest.java b/fe/fe-core/src/test/java/org/apache/doris/qe/AuditEventProcessorTest.java
@@ -53,6 +53,7 @@ public static void tearDown() {
     public void testAuditEvent() {
         AuditEvent event = new AuditEvent.AuditEventBuilder().setEventType(EventType.AFTER_QUERY)
                 .setTimestamp(System.currentTimeMillis())
+                .setSessionId("sessionId")
                 .setClientIp("127.0.0.1")
                 .setUser("user1")
                 .setDb("db1")
@@ -80,6 +81,7 @@ public void testAuditLogBuilder() throws IOException {
             for (int i = 0; i < 10000; i++) {
                 AuditEvent event = new AuditEvent.AuditEventBuilder().setEventType(EventType.AFTER_QUERY)
                         .setTimestamp(System.currentTimeMillis())
+                        .setSessionId("sessionId")
                         .setClientIp("127.0.0.1")
                         .setUser("user1")
                         .setDb("db1")
@@ -106,6 +108,7 @@ public void testAuditEventProcessor() throws IOException {
         for (int i = 0; i < 10000; i++) {
             AuditEvent event = new AuditEvent.AuditEventBuilder().setEventType(EventType.AFTER_QUERY)
                     .setTimestamp(System.currentTimeMillis())
+                    .setSessionId("sessionId")
                     .setClientIp("127.0.0.1")
                     .setUser("user1")
                     .setDb("db1")

diff --git a/...ins/auditloader/src/main/java/org/apache/doris/plugin/audit/custom/AuditLoaderPlugin.java b/...ins/auditloader/src/main/java/org/apache/doris/plugin/audit/custom/AuditLoaderPlugin.java
@@ -161,6 +161,7 @@ private void assembleAudit(AuditEvent event) {
     private void fillLogBuffer(AuditEvent event, StringBuilder logBuffer) {
         logBuffer.append(event.queryId).append("\t");
         logBuffer.append(longToTimeString(event.timestamp)).append("\t");
+        logBuffer.append(event.sessionId).append("\t");
         logBuffer.append(event.clientIp).append("\t");
         logBuffer.append(event.user).append("\t");
         logBuffer.append(event.ctl).append("\t");

diff --git a/pytest/deploy/start.py b/pytest/deploy/start.py
@@ -179,6 +179,7 @@ def add_auditload_plugin():
           ( \
               query_id varchar(48) comment 'Unique query id', \
               \`time\` datetime not null comment 'Query start time', \
+              session_id varchar(36) comment 'Session id', \
               client_ip varchar(32) comment 'Client IP', \
               user varchar(64) comment 'User name', \
               db varchar(96) comment 'Database of this query', \
@@ -196,7 +197,7 @@ def add_auditload_plugin():
               peak_memory_bytes bigint comment 'Peak memory bytes used on all backends of this query', \
               stmt string comment 'The original statement, trimed if longer than 2G ' \
           ) engine=OLAP \
-          duplicate key(query_id, \`time\`, client_ip) \
+          duplicate key(query_id, \`time\`, session_id) \
           partition by range(\`time\`) () \
           distributed by hash(query_id) buckets 1 \
           properties( \

diff --git a/regression-test/data/audit/test_audit_log_behavior.out b/regression-test/data/audit/test_audit_log_behavior.out
@@ -2,7 +2,8 @@
 -- !audit_log_schema --
 query_id	varchar(48)	Yes	true	\N	
 time	datetime(3)	Yes	true	\N	
-client_ip	varchar(128)	Yes	true	\N	
+session_id	varchar(36)	Yes	true	\N	
+client_ip	varchar(128)	Yes	false	\N	NONE
 user	varchar(128)	Yes	false	\N	NONE
 frontend_ip	varchar(1024)	Yes	false	\N	NONE
 catalog	varchar(128)	Yes	false	\N	NONE

diff --git a/regression-test/suites/manager/test_manager_interface_1.groovy b/regression-test/suites/manager/test_manager_interface_1.groovy
@@ -527,6 +527,7 @@ suite('test_manager_interface_1',"p0") {
         assertTrue(result[0][1].contains("CREATE TABLE `audit_log`"))
         assertTrue(result[0][1].contains("`query_id` varchar(128) NULL,"))
         assertTrue(result[0][1].contains("`time` datetime(3) NULL,"))
+        assertTrue(result[0][1].contains("`session_id` varchar(36) NULL,"))
         assertTrue(result[0][1].contains("`client_ip` varchar(128) NULL,")) 
         assertTrue(result[0][1].contains("`user` varchar(128) NULL,")) 
         assertTrue(result[0][1].contains("`catalog` varchar(128) NULL")) 
@@ -550,7 +551,7 @@ suite('test_manager_interface_1',"p0") {
 
         assertTrue(result[0][1].contains("ENGINE=OLAP"))
 
-        assertTrue(result[0][1].contains("DUPLICATE KEY(`query_id`, `time`, `client_ip`)"))
+        assertTrue(result[0][1].contains("DUPLICATE KEY(`query_id`, `time`, `session_id`)"))
         assertTrue(result[0][1].contains("""PARTITION BY RANGE(`time`)"""))
         assertTrue(result[0][1].contains("""dynamic_partition.enable" = "true"""))
         assertTrue(result[0][1].contains("""dynamic_partition.time_unit" = "DAY"""))