Query audit
The data-plane audit trail of the SQL queries proxied through Relay on connections with audit enabled.
The query audit log is Relay's data-plane audit trail: every SQL query
proxied through the agent is recorded and searchable, for
connections that have audit enabled. Audit is on by default for new connections; turn it off per
connection in the dashboard or with relay connections create --audit-enabled=false.
Each entry captures the time, connection, database user, database, and a type — query, prepared, blocked, or alert (MongoDB connections also record a command type) — along with the query text. Opening an entry shows the query, any policy decision (deny, approve or alert) with its reason and rule, the client address, and the agent and connection IDs. On connections with risk scoring, entries also carry the risk level and its reasons.
Filter by time window, connection, user, and type; a live mode refreshes the view as new queries arrive.
Query audit vs. activity log
- Query audit (this page) — the data plane: every SQL query that flows through Relay's proxy.
- Activity log — the control plane: who did what to Relay resources (created a connection, changed a role, deleted a backup, …).
Use query audit to answer "what queries ran against this database?" and the activity log to answer "who changed this in Relay?".