Selective database logging with smart sampling

A set of one or more non-transitory computer readable storage media storing instructions which, when executed by one or more processors of one or more electronic devices implementing a database agent that is communicatively coupled to a security analysis server and that monitors database connections established between one or more database clients and one or more databases, causes the database agent to perform operations comprising:

• sending, to the security analysis server because of a current configuration of the database agent, a count of an amount of traffic, rather than all traffic, sent over each database connection in a first set of one or more of the database connections being monitored by the database agent;
• receiving, from the security analysis server, an instruction to send to the security analysis server a count of an amount of traffic, rather than all the traffic, sent over each database connection in a second set of one or more of the database connections being monitored by the database agent that have been determined by the security analysis server to be of an application database connection type and to send to the security analysis server traffic sent over other database connections;
• and
• responsive to receiving the instruction, sending, to the security analysis server, the count of the amount of traffic, rather than all the traffic, sent over each database connection in the second set of one or more database connections and sending to the security analysis server traffic sent over the other database connections.

An electronic device configured to implement a database agent that monitors database connections established between one or more database clients and one or more databases, wherein the database agent is communicatively coupled to a security analysis server, the electronic device comprising:

• one or more processors;
• and
• a non-transitory machine-readable storage medium having instructions stored therein, which when executed by the one or more processors, cause the database agent to:
• send, to the security analysis server because of a current configuration of the database agent, a count of an amount of traffic, rather than all traffic, sent over each database connection in a first set of one or more of the database connections being monitored by the database agent,
• receive, from the security analysis server, an instruction to send to the security analysis server a count of an amount of traffic, rather than all the traffic, sent over each database connection in a second set of one or more of the database connections being monitored by the database agent that have been determined by the security analysis server to be of an application database connection type and to send to the security analysis server traffic sent over other database connections, and
• responsive to receiving the instruction, send, to the security analysis server, the count of the amount of traffic, rather than all the traffic, sent over each database connection in the second set of one or more database connections and sending to the security analysis server traffic sent over the other database connections.