apache · leto-b · May 6, 2026
diff --git a/src/UserGuide/Master/Table/IoTDB-Introduction/Release-history_timecho.md b/src/UserGuide/Master/Table/IoTDB-Introduction/Release-history_timecho.md
@@ -34,7 +34,6 @@ Version 2.0.8.2 adds support for modifying the full path of time series in the t
 - Storage Module: The tree model supports [modifying the full name of time series](../../latest/Basic-Concept/Operate-Metadata_timecho.md#_2-4-修改时间序列名称) and [changing the data type of time series](../../latest/Basic-Concept/Operate-Metadata_timecho.md#_2-3-修改时间序列数据类型).
 - Storage Module: The table model supports [modifying column data types](../Basic-Concept/Table-Management_timecho.md#_1-5-修改表) and [customizing the Time column name](../Basic-Concept/Table-Management_timecho.md#_1-1-创建表).
 - Interface Module: Adds support for the [ODBC Driver](../API/Programming-ODBC_timecho.md); the Python SessionDataset supports fetching DataFrames in batches; the MQTT service is externalized, and a new system table named Services is added for service queries.
-- System Module: The [audit log](../User-Manual/Audit-Log_timecho.md) now supports statistics on the number of slow requests.
 - AI Node: The table model supports adaptive [covariate inference](../AI-capability/AINode_Upgrade_timecho.md#_4-1-模型推理).
 - Stream Processing Module: The tree model data synchronization PIPE statement supports specifying multiple precise paths.
 

diff --git a/src/UserGuide/Master/Table/User-Manual/Audit-Log_timecho.md b/src/UserGuide/Master/Table/User-Manual/Audit-Log_timecho.md
diff --git a/src/UserGuide/Master/Tree/IoTDB-Introduction/Release-history_timecho.md b/src/UserGuide/Master/Tree/IoTDB-Introduction/Release-history_timecho.md
@@ -34,7 +34,6 @@ Version 2.0.8.2 adds support for modifying the full path of time series in the t
 - Storage Module: The tree model supports [modifying the full name of time series](../Basic-Concept/Operate-Metadata_timecho.md#_2-4-修改时间序列名称) and [changing the data type of time series](../Basic-Concept/Operate-Metadata_timecho.md#_2-3-修改时间序列数据类型).
 - Storage Module: The table model supports [modifying column data types](../../latest-Table/Basic-Concept/Table-Management_timecho.md#_1-5-修改表) and [customizing the Time column name](../../latest-Table/Basic-Concept/Table-Management_timecho.md#_1-1-创建表).
 - Interface Module: Adds support for the [ODBC Driver](../API/Programming-ODBC_timecho.md); the Python SessionDataset supports fetching DataFrames in batches; the MQTT service is externalized, and a new system table named Services is added for service queries.
-- System Module: The [audit log](../User-Manual/Audit-Log_timecho.md) now supports statistics on the number of slow requests.
 - AI Node: The table model supports adaptive [covariate inference](../../latest-Table/AI-capability/AINode_Upgrade_timecho.md#_4-1-模型推理).
 - Stream Processing Module: The tree model data synchronization PIPE statement supports specifying multiple precise paths.
 

diff --git a/src/UserGuide/Master/Tree/User-Manual/Audit-Log_timecho.md b/src/UserGuide/Master/Tree/User-Manual/Audit-Log_timecho.md
@@ -38,7 +38,6 @@ Audit logs serve as the record credentials of a database, enabling tracking of v
 
 Edit the `iotdb-system.properties` file to enable audit logging using the following parameters:
 
-
 * V2.0.8.1
 
 | Parameter Name                              | Description                                                                                                 | Data Type | Default Value                 | Activation Method |
@@ -52,8 +51,7 @@ Edit the `iotdb-system.properties` file to enable audit logging using the follow
 | `audit_log_batch_interval_in_ms`          | Batch write interval for audit logs                                                                          | Long      | 1000                            | Hot Reload        |
 | `audit_log_batch_max_queue_bytes`         | Maximum byte size of the queue for batch processing audit logs. Subsequent write operations will be blocked when this threshold is exceeded. | Long      | 268435456                       | Hot Reload        |
 
-* V2.0.8.2
-
+* V2.0.9.2
 
 | Parameter Name                              | Description                                                                                                 | Data Type | Default Value                 | Activation Method |
 |-------------------------------------------|------------------------------------------------------------------------------------------------------------|-----------|-------------------------------|-------------------|
@@ -74,6 +72,7 @@ Edit the `iotdb-system.properties` file to enable audit logging using the follow
 - When the parameters `auditable_dml_event_type`, `auditable_ddl_event_type`, `auditable_query_event_type`, or `auditable_control_event_type` are set to `OBJECT_AUTHENTICATION`, the corresponding event types will be recorded in the audit log.
 - When the parameters `auditable_dml_event_type`, `auditable_ddl_event_type`, `auditable_query_event_type`, or `auditable_control_event_type` are set to `SLOW_OPERATION`, only the corresponding event types whose execution time exceeds the value of the `slow_query_threshold` parameter (default: 3000 ms) will be recorded in the audit log. The value of the `slow_query_threshold` parameter can be configured in the `iotdb-system.properties` file.
 
+
 ## 3. Access Methods
 
 Supports direct reading of audit logs via SQL.
@@ -150,15 +149,17 @@ Total line number = 4
 It costs 0.024s
 ```
 
-* Query audit records for user 'u_0' on node 'node_1' with event types 'SLOW_OPERATION' and 'LOGIN'
+* Query audit records for user 'u_0' on node 'node_1' with event types 'SLOW_OPERATION'
 
 ```SQL
-IoTDB> select * from root.__audit.log.node_1.u_0 where audit_event_type='SLOW_OPERATION' or audit_event_type='LOGIN' limit 1 align by device 
-+-----------------------------+---------------------------+------+---------------+--------------+--------+--------------+-----------------------------------------------------------------------------------------------+----------+----------------+------------+--------+
-|                         Time|                     Device|result|privilege_level|privilege_type|database|operation_type|                                                                                            log|sql_string|audit_event_type|cli_hostname|username|
-+-----------------------------+---------------------------+------+---------------+--------------+--------+--------------+-----------------------------------------------------------------------------------------------+----------+----------------+------------+--------+
-|2026-01-23T11:42:23.636+08:00|root.__audit.log.node_1.u_0|  true|         GLOBAL|          null|        |       CONTROL|IoTDB: Login status: Login successfully. User root (ID=0), opens Session-1-root:127.0.0.1:51308|          |           LOGIN|   127.0.0.1|    root|
-+-----------------------------+---------------------------+------+---------------+--------------+--------+--------------+-----------------------------------------------------------------------------------------------+----------+----------------+------------+--------+
-Total line number = 1
-It costs 0.021s
-```
+IoTDB> select * from root.__audit.log.node_1.u_0 where audit_event_type='SLOW_OPERATION' align by device
++-----------------------------+---------------------------+------+---------------+--------------+--------+--------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------+----------------+------------+--------+
+|                         Time|                     Device|result|privilege_level|privilege_type|database|operation_type|                                                                                                                                                                    log|                                                                                                                          sql_string|audit_event_type|cli_hostname|username|
++-----------------------------+---------------------------+------+---------------+--------------+--------+--------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------+----------------+------------+--------+
+|2026-05-06T14:43:55.088+08:00|root.__audit.log.node_1.u_0|  true|         OBJECT|   [READ_DATA]|        |         QUERY|           SLOW_QUERY: cost 60 ms, select * from root.__audit.log.node_1.u_0 where audit_event_type='SLOW_OPERATION' or audit_event_type='LOGIN'limit 1 align by device|select * from root.__audit.log.node_1.u_0 where audit_event_type='SLOW_OPERATION' or audit_event_type='LOGIN'limit 1 align by device|  SLOW_OPERATION|   127.0.0.1|    root|
+|2026-05-06T14:44:08.715+08:00|root.__audit.log.node_1.u_0|  true|         OBJECT|  [WRITE_DATA]|        |           DML|              Execution: insert into root.ln.wf02.wt02(timestamp, status, hardware) values (2, false, 'v2') cost 290 ms, with status code: TSStatus(code:200, message:)|                                                  insert into root.ln.wf02.wt02(timestamp, status, hardware) values (2, false, 'v2')|  SLOW_OPERATION|   127.0.0.1|    root|
+|2026-05-06T14:44:11.684+08:00|root.__audit.log.node_1.u_0|  true|         OBJECT|  [WRITE_DATA]|        |           DML|Execution: insert into root.ln.wf02.wt02(timestamp, status, hardware) VALUES (3, false, 'v3'),(4, true, 'v4') cost 6 ms, with status code: TSStatus(code:200, message:)|                                  insert into root.ln.wf02.wt02(timestamp, status, hardware) VALUES (3, false, 'v3'),(4, true, 'v4')|  SLOW_OPERATION|   127.0.0.1|    root|
++-----------------------------+---------------------------+------+---------------+--------------+--------+--------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------+----------------+------------+--------+
+Total line number = 3
+It costs 0.010s
+```
diff --git a/src/UserGuide/latest-Table/IoTDB-Introduction/Release-history_timecho.md b/src/UserGuide/latest-Table/IoTDB-Introduction/Release-history_timecho.md
@@ -34,7 +34,6 @@ Version 2.0.8.2 adds support for modifying the full path of time series in the t
 - Storage Module: The tree model supports [modifying the full name of time series](../../latest/Basic-Concept/Operate-Metadata_timecho.md#_2-4-修改时间序列名称) and [changing the data type of time series](../../latest/Basic-Concept/Operate-Metadata_timecho.md#_2-3-修改时间序列数据类型).
 - Storage Module: The table model supports [modifying column data types](../Basic-Concept/Table-Management_timecho.md#_1-5-修改表) and [customizing the Time column name](../Basic-Concept/Table-Management_timecho.md#_1-1-创建表).
 - Interface Module: Adds support for the [ODBC Driver](../API/Programming-ODBC_timecho.md); the Python SessionDataset supports fetching DataFrames in batches; the MQTT service is externalized, and a new system table named Services is added for service queries.
-- System Module: The [audit log](../User-Manual/Audit-Log_timecho.md) now supports statistics on the number of slow requests.
 - AI Node: The table model supports adaptive [covariate inference](../AI-capability/AINode_Upgrade_timecho.md#_4-1-模型推理).
 - Stream Processing Module: The tree model data synchronization PIPE statement supports specifying multiple precise paths.