cloud: Premium db auditing doc improvement

[ginkgoch]

First-time contributors' checklist

• I've signed the Contributor License Agreement, which is required for the repository owners to accept my contribution.

What is changed, added or deleted? (Required)

The premium db auditing has two mistake, fix it in this PR.

1. missing more setting options, like flush size/interval
2. the filter rule is deprecated in new audit log

Which TiDB version(s) do your changes apply to? (Required)

Tips for choosing the affected version(s):

By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.

For details, see tips for choosing the affected versions.

• master (the latest development version)
• v9.0 (TiDB 9.0 versions)
• v8.5 (TiDB 8.5 versions)
• v8.1 (TiDB 8.1 versions)
• v7.5 (TiDB 7.5 versions)
• v7.1 (TiDB 7.1 versions)
• v6.5 (TiDB 6.5 versions)

What is the related PR or file link(s)?

• This PR is translated from:
• Other reference link(s):

AI agent involvement

• The changes in this PR were primarily made by an AI agent on behalf of the PR author.

Do your changes match any of the following descriptions?

• Delete files
• Change aliases
• Need modification after applied to another branch
• Might cause conflicts after applied to another branch

Summary by CodeRabbit

• Documentation
  • Added guidance for configuring database audit logging, including log rotation, log redaction, and enabling saved settings.
  • Updated audit filter instructions to support named filters, SQL user patterns, and selectable event types.
  • Added a reference table covering connection, query, DML, transaction, and audit events.
  • Clarified that % matches zero or more characters and _ matches exactly one character in SQL user filters.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The audit logging documentation now covers logging configuration, redaction, filter-rule creation, selectable audit events, event classes, and SQL user pattern matching.

Changes

Audit logging documentation

Layer / File(s)	Summary
Configure audit logging tidb-cloud/premium/tidb-cloud-auditing-premium.md	Adds instructions for log rotation, log redaction, default redaction behavior, and the Save and Enable action.
Define audit filter rules tidb-cloud/premium/tidb-cloud-auditing-premium.md	Replaces expression-based rules with named filters, SQL user patterns, and selected events. Adds supported audit event classes.
Clarify SQL user patterns tidb-cloud/tidb-cloud-auditing.md	Defines % as matching zero or more characters and _ as matching exactly one character.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🔵 Low · up to c7761

This change improves Premium database-auditing documentation, but it still has bounded correctness risks around rendered user-pattern examples, the TiDB version requirement for time-based rotation, and the syntax and semantics of audit filters; these should receive explicit owner follow-up before or with merge.

Possibly related PRs

• pingcap/docs#23365: Documents related TiDB Cloud Dedicated audit logging and filter-rule configuration.

Suggested labels: area/tidb-cloud

Suggested reviewers: qiancai, wildpcww

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the changes, but it does not select the required TiDB version even though the objective targets release 8.5.	Select the applicable version checkbox, at minimum v8.5, and confirm whether master or other branches are also affected.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies an improvement to the Premium database auditing documentation, which matches the main changes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 09a9e6a4-b01c-4f31-968e-4e62bbed50c7

📥 Commits

Reviewing files that changed from the base of the PR and between bf15a0a and 41de6b9.

📒 Files selected for processing (1)

• tidb-cloud/premium/tidb-cloud-auditing-premium.md

Included review availability: Your plan includes up to 4 reviews per rolling hour; 3 remain after this review.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

tidb-cloud/premium/tidb-cloud-auditing-premium.md (1)

254-271: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Document the actual rotation controls.

This section has no flush-size or flush-interval options. Use rotation size in MiB and rotation interval in minutes, and document the Premium-specific defaults and valid ranges. The existing step already states that Save and Enable applies the settings. Do not describe these controls as flush settings.

Source: Path instructions

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ca8af3e-eed4-4fb8-b1fa-58aaaa755dbf

📥 Commits

Reviewing files that changed from the base of the PR and between 41de6b9 and da079b4.

📒 Files selected for processing (1)

• tidb-cloud/premium/tidb-cloud-auditing-premium.md

Included review availability: Your plan includes up to 4 reviews per rolling hour; 2 remain after this review.

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

tidb-cloud/premium/tidb-cloud-auditing-premium.md (1)

254-270: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Document the TiDB version requirement for time-based rotation.

The Premium page states that time-based rotation is always available. Add the existing requirement that this option applies only to TiDB v8.5.2 or later.

Suggested replacement

    You can rotate audit log files based on either file size or time interval. When either condition is met, TiDB Cloud generates a new audit log file.

    > **Note:**
    >
    > Log file rotation based on time interval only applies to TiDB v8.5.2 or later. If the TiDB version of your TiDB Cloud Dedicated cluster is earlier than v8.5.2, you can only rotate audit log files based on file size.

Source: Path instructions

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b36a37be-2797-444d-92fe-ad323a13004f

📥 Commits

Reviewing files that changed from the base of the PR and between da079b4 and c776180.

📒 Files selected for processing (2)

• tidb-cloud/premium/tidb-cloud-auditing-premium.md
• tidb-cloud/tidb-cloud-auditing.md

Included review availability: Your plan includes up to 4 reviews per rolling hour; 3 remain after this review.

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-08-17 02:26:59.134262677 +0000 UTC m=+3618205.170357732: ☑️ agreed by qiancai.

[qiancai]

/approve

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: qiancai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [qiancai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment