Amazon RDS and Aurora (MySQL) Logs

Ship MySQL error, slow query, general, audit, and IAM authentication error logs from Amazon RDS and Aurora MySQL to Bronto to diagnose slow queries, connection failures, and replication issues.

Amazon RDS and Aurora can publish MySQL logs to CloudWatch Log Groups, where they become available for ingestion. RDS and Aurora don’t deliver these logs directly to Amazon Data Firehose or S3.

Log type	Export name	Requirement
Error log	error	Enabled by default
Slow query log	slowquery	slow_query_log = 1 and log_output = FILE in a custom parameter group
General log	general	general_log = 1 and log_output = FILE in a custom parameter group
Audit log	audit	RDS: MARIADB_AUDIT_PLUGIN option in a custom option group. Aurora: Advanced Auditing
IAM DB authentication error log	iam-db-auth-error	IAM database authentication enabled
Instance log (Aurora only)	instance	—

Log groups are named /aws/rds/instance/<instance>/<log_type> for RDS and /aws/rds/cluster/<cluster>/<log_type> for Aurora.

​

Recommended method

CloudWatch Log Forwarder — enable the log exports you need on the DB instance or cluster (Modify → Log exports), and the Bronto forwarder Lambda subscribes to the resulting CloudWatch Log Groups and streams events into Bronto.

​

Alternatives

• Amazon Data Firehose — for very high-volume environments. Enable MySQL log exports to CloudWatch Logs, then add a subscription filter on each log group targeting a Firehose stream. MySQL logs arrive as plain text (slow-query blocks, error, general and audit logs), so Bronto stores them raw and a custom parser is required to extract fields. See Record formats.

See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​

References

• Amazon RDS — publishing MySQL logs to CloudWatch Logs
• Amazon Aurora — publishing Aurora MySQL logs to CloudWatch Logs
• Amazon RDS — MySQL log access