diff --git a/include/common/tglobal.h b/include/common/tglobal.h
index cf918c6e0d..3a7f307cfa 100644
--- a/include/common/tglobal.h
+++ b/include/common/tglobal.h
@@ -140,6 +140,7 @@ extern bool     tsMonitorForceV2;
 // audit
 extern bool    tsEnableAudit;
 extern bool    tsEnableAuditCreateTable;
+extern bool    tsEnableAuditDelete;
 extern int32_t tsAuditInterval;
 
 // telem
diff --git a/include/common/tmsg.h b/include/common/tmsg.h
index 1a10f02c96..0008bc0e9d 100644
--- a/include/common/tmsg.h
+++ b/include/common/tmsg.h
@@ -1795,6 +1795,17 @@ int32_t tSerializeSStatisReq(void* buf, int32_t bufLen, SStatisReq* pReq);
 int32_t tDeserializeSStatisReq(void* buf, int32_t bufLen, SStatisReq* pReq);
 void    tFreeSStatisReq(SStatisReq* pReq);
 
+typedef struct {
+  char    db[TSDB_DB_FNAME_LEN];
+  char    table[TSDB_TABLE_NAME_LEN];
+  char    operation[AUDIT_OPERATION_LEN];
+  int32_t sqlLen;
+  char*   pSql;
+} SAuditReq;
+int32_t tSerializeSAuditReq(void* buf, int32_t bufLen, SAuditReq* pReq);
+int32_t tDeserializeSAuditReq(void* buf, int32_t bufLen, SAuditReq* pReq);
+void    tFreeSAuditReq(SAuditReq* pReq);
+
 typedef struct {
   int32_t dnodeId;
   int64_t clusterId;
diff --git a/include/common/tmsgdef.h b/include/common/tmsgdef.h
index 40464dc29a..4a2206bd2b 100644
--- a/include/common/tmsgdef.h
+++ b/include/common/tmsgdef.h
@@ -254,6 +254,7 @@
   TD_DEF_MSG_TYPE(TDMT_MND_STREAM_DROP_ORPHANTASKS, "stream-drop-orphan-tasks", NULL, NULL)
   TD_DEF_MSG_TYPE(TDMT_MND_STREAM_TASK_RESET, "stream-reset-tasks", NULL, NULL)
   TD_DEF_MSG_TYPE(TDMT_MND_UPDATE_DNODE_INFO, "update-dnode-info", NULL, NULL)
+  TD_DEF_MSG_TYPE(TDMT_MND_AUDIT, "audit", NULL, NULL)
   TD_CLOSE_MSG_SEG(TDMT_END_MND_MSG)
 
   TD_NEW_MSG_SEG(TDMT_VND_MSG)  // 2<<8
diff --git a/include/libs/audit/audit.h b/include/libs/audit/audit.h
index 2e786ab2b3..f5710256e9 100644
--- a/include/libs/audit/audit.h
+++ b/include/libs/audit/audit.h
@@ -29,7 +29,6 @@ extern "C" {
 #endif
 
 #define AUDIT_DETAIL_MAX 65472
-#define AUDIT_OPERATION_LEN 20
 
 typedef struct {
   const char *server;
diff --git a/include/util/tdef.h b/include/util/tdef.h
index a2bc77d819..970570683d 100644
--- a/include/util/tdef.h
+++ b/include/util/tdef.h
@@ -604,6 +604,7 @@ enum { RAND_ERR_MEMORY = 1, RAND_ERR_FILE = 2, RAND_ERR_NETWORK = 4 };
 #define MONITOR_TAG_VALUE_LEN   300
 #define MONITOR_METRIC_NAME_LEN 100
 
+#define AUDIT_OPERATION_LEN 20
 #ifdef __cplusplus
 }
 #endif
diff --git a/source/common/src/tglobal.c b/source/common/src/tglobal.c
index 3c05294264..b85fea632e 100644
--- a/source/common/src/tglobal.c
+++ b/source/common/src/tglobal.c
@@ -117,6 +117,7 @@ bool     tsMonitorForceV2 = true;
 // audit
 bool    tsEnableAudit = true;
 bool    tsEnableAuditCreateTable = true;
+bool    tsEnableAuditDelete = true;
 int32_t tsAuditInterval = 5000;
 
 // telem
@@ -763,6 +764,7 @@ static int32_t taosAddServerCfg(SConfig *pCfg) {
   TAOS_CHECK_RETURN(cfgAddBool(pCfg, "monitorForceV2", tsMonitorForceV2, CFG_SCOPE_SERVER, CFG_DYN_NONE));
 
   TAOS_CHECK_RETURN(cfgAddBool(pCfg, "audit", tsEnableAudit, CFG_SCOPE_SERVER, CFG_DYN_ENT_SERVER));
+  TAOS_CHECK_RETURN(cfgAddBool(pCfg, "enableAuditDelete", tsEnableAuditDelete, CFG_SCOPE_SERVER, CFG_DYN_NONE));
   TAOS_CHECK_RETURN(cfgAddBool(pCfg, "auditCreateTable", tsEnableAuditCreateTable, CFG_SCOPE_SERVER, CFG_DYN_NONE));
   TAOS_CHECK_RETURN(cfgAddInt32(pCfg, "auditInterval", tsAuditInterval, 500, 200000, CFG_SCOPE_SERVER, CFG_DYN_NONE));
 
@@ -1448,6 +1450,9 @@ static int32_t taosSetServerCfg(SConfig *pCfg) {
   TAOS_CHECK_GET_CFG_ITEM(pCfg, pItem, "auditCreateTable");
   tsEnableAuditCreateTable = pItem->bval;
 
+  TAOS_CHECK_GET_CFG_ITEM(pCfg, pItem, "enableAuditDelete");
+  tsEnableAuditDelete = pItem->bval;
+
   TAOS_CHECK_GET_CFG_ITEM(pCfg, pItem, "auditInterval");
   tsAuditInterval = pItem->i32;
 
diff --git a/source/common/src/tmsg.c b/source/common/src/tmsg.c
index 4c4b78278e..10c84d9bf8 100644
--- a/source/common/src/tmsg.c
+++ b/source/common/src/tmsg.c
@@ -1802,6 +1802,60 @@ _exit:
 
 void tFreeSDropUserReq(SDropUserReq *pReq) { FREESQL(); }
 
+int32_t tSerializeSAuditReq(void *buf, int32_t bufLen, SAuditReq *pReq) {
+  SEncoder encoder = {0};
+  int32_t  code = 0;
+  int32_t  lino;
+  int32_t  tlen;
+  tEncoderInit(&encoder, buf, bufLen);
+
+  TAOS_CHECK_EXIT(tStartEncode(&encoder));
+
+  TAOS_CHECK_EXIT(tEncodeCStr(&encoder, pReq->operation));
+  TAOS_CHECK_EXIT(tEncodeCStr(&encoder, pReq->db));
+  TAOS_CHECK_EXIT(tEncodeCStr(&encoder, pReq->table));
+  TAOS_CHECK_EXIT(tEncodeI32(&encoder, pReq->sqlLen));
+  TAOS_CHECK_EXIT(tEncodeCStr(&encoder, pReq->pSql));
+
+  tEndEncode(&encoder);
+
+_exit:
+  if (code) {
+    tlen = code;
+  } else {
+    tlen = encoder.pos;
+  }
+  tEncoderClear(&encoder);
+  return tlen;
+}
+
+int32_t tDeserializeSAuditReq(void *buf, int32_t bufLen, SAuditReq *pReq) {
+  SDecoder decoder = {0};
+  int32_t  code = 0;
+  int32_t  lino;
+  tDecoderInit(&decoder, buf, bufLen);
+
+  TAOS_CHECK_EXIT(tStartDecode(&decoder));
+
+  TAOS_CHECK_EXIT(tDecodeCStrTo(&decoder, pReq->operation));
+  TAOS_CHECK_EXIT(tDecodeCStrTo(&decoder, pReq->db));
+  TAOS_CHECK_EXIT(tDecodeCStrTo(&decoder, pReq->table));
+  TAOS_CHECK_EXIT(tDecodeI32(&decoder, &pReq->sqlLen));
+  if (pReq->sqlLen > 0) {
+    pReq->pSql = taosMemoryMalloc(pReq->sqlLen + 1);
+    if (pReq->pSql == NULL) {
+      TAOS_CHECK_EXIT(terrno);
+    }
+    TAOS_CHECK_EXIT(tDecodeCStrTo(&decoder, pReq->pSql));
+  }
+  tEndDecode(&decoder);
+_exit:
+  tDecoderClear(&decoder);
+  return code;
+}
+
+void tFreeSAuditReq(SAuditReq *pReq) { taosMemoryFreeClear(pReq->pSql); }
+
 SIpWhiteList *cloneIpWhiteList(SIpWhiteList *pIpWhiteList) {
   if (pIpWhiteList == NULL) return NULL;
 
diff --git a/source/dnode/mgmt/mgmt_mnode/src/mmHandle.c b/source/dnode/mgmt/mgmt_mnode/src/mmHandle.c
index 7204cde8f7..a182307c49 100644
--- a/source/dnode/mgmt/mgmt_mnode/src/mmHandle.c
+++ b/source/dnode/mgmt/mgmt_mnode/src/mmHandle.c
@@ -208,6 +208,7 @@ SArray *mmGetMsgHandles() {
   if (dmSetMgmtHandle(pArray, TDMT_MND_DROP_VIEW, mmPutMsgToWriteQueue, 0) == NULL) goto _OVER;
   if (dmSetMgmtHandle(pArray, TDMT_MND_VIEW_META, mmPutMsgToReadQueue, 0) == NULL) goto _OVER;
   if (dmSetMgmtHandle(pArray, TDMT_MND_STATIS, mmPutMsgToReadQueue, 0) == NULL) goto _OVER;
+  if (dmSetMgmtHandle(pArray, TDMT_MND_AUDIT, mmPutMsgToReadQueue, 0) == NULL) goto _OVER;
   if (dmSetMgmtHandle(pArray, TDMT_MND_KILL_COMPACT, mmPutMsgToReadQueue, 0) == NULL) goto _OVER;
   if (dmSetMgmtHandle(pArray, TDMT_MND_CONFIG_CLUSTER, mmPutMsgToWriteQueue, 0) == NULL) goto _OVER;
   if (dmSetMgmtHandle(pArray, TDMT_VND_QUERY_COMPACT_PROGRESS_RSP, mmPutMsgToReadQueue, 0) == NULL) goto _OVER;
diff --git a/source/dnode/mnode/impl/src/mndDnode.c b/source/dnode/mnode/impl/src/mndDnode.c
index 04041646eb..8eedcaa906 100644
--- a/source/dnode/mnode/impl/src/mndDnode.c
+++ b/source/dnode/mnode/impl/src/mndDnode.c
@@ -86,6 +86,7 @@ static int32_t mndProcessStatusReq(SRpcMsg *pReq);
 static int32_t mndProcessNotifyReq(SRpcMsg *pReq);
 static int32_t mndProcessRestoreDnodeReq(SRpcMsg *pReq);
 static int32_t mndProcessStatisReq(SRpcMsg *pReq);
+static int32_t mndProcessAuditReq(SRpcMsg *pReq);
 static int32_t mndProcessUpdateDnodeInfoReq(SRpcMsg *pReq);
 static int32_t mndProcessCreateEncryptKeyReq(SRpcMsg *pRsp);
 static int32_t mndProcessCreateEncryptKeyRsp(SRpcMsg *pRsp);
@@ -125,6 +126,7 @@ int32_t mndInitDnode(SMnode *pMnode) {
   mndSetMsgHandle(pMnode, TDMT_MND_SHOW_VARIABLES, mndProcessShowVariablesReq);
   mndSetMsgHandle(pMnode, TDMT_MND_RESTORE_DNODE, mndProcessRestoreDnodeReq);
   mndSetMsgHandle(pMnode, TDMT_MND_STATIS, mndProcessStatisReq);
+  mndSetMsgHandle(pMnode, TDMT_MND_AUDIT, mndProcessAuditReq);
   mndSetMsgHandle(pMnode, TDMT_MND_CREATE_ENCRYPT_KEY, mndProcessCreateEncryptKeyReq);
   mndSetMsgHandle(pMnode, TDMT_DND_CREATE_ENCRYPT_KEY_RSP, mndProcessCreateEncryptKeyRsp);
   mndSetMsgHandle(pMnode, TDMT_MND_UPDATE_DNODE_INFO, mndProcessUpdateDnodeInfoReq);
@@ -604,6 +606,21 @@ static int32_t mndProcessStatisReq(SRpcMsg *pReq) {
   return 0;
 }
 
+static int32_t mndProcessAuditReq(SRpcMsg *pReq) {
+  if (tsEnableAudit && tsEnableAuditDelete) {
+    SMnode   *pMnode = pReq->info.node;
+    SAuditReq auditReq = {0};
+
+    TAOS_CHECK_RETURN(tDeserializeSAuditReq(pReq->pCont, pReq->contLen, &auditReq));
+
+    auditAddRecord(pReq, pMnode->clusterId, auditReq.operation, auditReq.db, auditReq.table, auditReq.pSql,
+                   auditReq.sqlLen);
+
+    tFreeSAuditReq(&auditReq);
+  }
+  return 0;
+}
+
 static int32_t mndUpdateDnodeObj(SMnode *pMnode, SDnodeObj *pDnode) {
   int32_t       code = 0, lino = 0;
   SDnodeInfoReq infoReq = {0};