{
  "id": "audit_settings",
  "title": "",
  "url": "https://redis.io/docs/latest/operate/rs/references/rest-api/objects/bdb/audit_settings/",
  "summary": "",
  "tags": [],
  "last_updated": "2026-07-27T11:50:00+02:00",
  "page_type": "content",
  "content_hash": "4cb9646f8c134ef235b9cde6a7c5ce04e5571c1352e289a94f85e07f80684d73",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "Title: audit_settings\nalwaysopen: false\ncategories:\n- docs\n- operate\n- rs\ndescription: An object that configures per-database connection and command auditing\nlinkTitle: audit_settings\nweight: $10\n---\n\nConfigures per-database connection and command (CRUD) auditing"
    },
    {
      "id": "audit-settings-object",
      "title": "audit_settings object",
      "role": "content",
      "text": "| Name | Type/Value | Description |\n|---|---|---|\n| audit_mode | string; Values: `'disabled'`, `'connection'`, `'connection_and_crud'`; default: `'disabled'` | Per-database auditing mode. `'disabled'`: no audit records are generated. `'connection'`: audits connection and AUTH events only. `'connection_and_crud'`: audits connection, AUTH, and CRUD command events. Cannot be set to `'connection_and_crud'` without connection auditing also active. |\n| username_filter | [complex object](#username_filter); default: disabled | Filters which client usernames are included in or excluded from CRUD audit records. |\n| source_ip_filter | [complex object](#source_ip_filter); default: disabled | Filters which client source IPs are included in or excluded from CRUD audit records. |\n| max_total_key_bytes | integer (range: 0+) ; default: `131072` | Maximum total key bytes captured in a single command audit record. |\n\nFilter changes take effect for new client connections only. Existing connections continue to be audited according to the filters that were active when the connection was established."
    },
    {
      "id": "username-filter-object",
      "title": "username_filter object",
      "role": "content",
      "text": "Controls which client usernames are included in or excluded from CRUD audit records.\n\n| Name | Type/Value | Description |\n|---|---|---|\n| enabled | boolean; default: `false` | Enables the username filter. |\n| usernames | array of strings; default: `[]`; max 512 entries | Usernames to include or exclude, depending on `filter_type`. |\n| filter_type | string; Values: `'inclusive'`, `'exclusive'`; default: `'inclusive'` | `'inclusive'` audits only the listed usernames. `'exclusive'` audits all usernames except the listed ones. |\n| allow_while_username_unknown | boolean; default: `false` | Allows command auditing to proceed before the connection's username is known. |\n\n**Validation:**\n- Each username must be 1–255 characters, using printable ASCII characters only.\n- Usernames must not contain `&`, `<`, `>`, or double-quote characters.\n- If `enabled` is `true`, `usernames` must not be empty."
    },
    {
      "id": "source-ip-filter-object",
      "title": "source_ip_filter object",
      "role": "content",
      "text": "Controls which client source IP addresses are included in or excluded from CRUD audit records.\n\n| Name | Type/Value | Description |\n|---|---|---|\n| enabled | boolean; default: `false` | Enables the source IP filter. |\n| ip_addresses | array of strings; default: `[]` | Bare IPv4 or IPv6 addresses. |\n| cidr_ranges | array of strings; default: `[]` | IPv4 or IPv6 CIDR ranges. |\n| filter_type | string; Values: `'inclusive'`, `'exclusive'`; default: `'inclusive'` | `'inclusive'` audits only matching IPs/ranges. `'exclusive'` audits all except matching IPs/ranges. |\n\n**Validation:**\n- `ip_addresses` entries must be bare IPv4 or IPv6 addresses (no ranges or CIDR notation).\n- `cidr_ranges` entries must be valid IPv4 or IPv6 CIDR ranges.\n- If `enabled` is `true`, at least one `ip_addresses` or `cidr_ranges` entry is required.\n- The combined number of `ip_addresses` and `cidr_ranges` entries cannot exceed 512."
    }
  ],
  "examples": []
}