Shulou(Shulou.com)06/01 Report--

Server_audit is an audit plug-in embedded in mariadb, which is also applicable in mysql and is mainly used to record user operations.

1. Installation:

View your plug-in directory through show variables like 'plugin_dir';, mine is: / usr/lib64/mysql/plugin/ copy the downloaded plug-in server_audit.so to / usr/lib64/mysql/plugin/ Note chmod+x server_audit.so login mysql execute plug-in installation command: INSTALL PLUGIN server_audit SONAME' server_audit.so'; plug-in successfully installed with these global variables: show variables like'% audit%'

two。 Configuration:

Enter mysql to execute: change the global variable set global server_audit_excl_users='root';set global server_audit_events='QUERY_DDL,QUERY_DML';set global server_audit_file_path ='/ mysqllog/';set global server_audit_file_rotate_size=1073741824;set global server_audit_file_rotations=10;set global server_audit_file_rotate_now=ON;set global server_audit_logging=on Add # auditserver_audit_events='QUERY_DDL,QUERY_DML'server_audit_logging=onserver_audit_file_path = / mysqllog/server_audit_file_rotate_size=1Gserver_audit_file_rotations=10server_audit_file_rotate_now=ONserver_audit_excl_users=root to my.cnf

3. It is recommended that general log be closed

Set global general_log=off; comments on my.cnf general_log_file = / mysqllog/mysql.loggeneral_log = 1

4. Parameter description:

For more information, please refer to: https://mariadb.com/kb/en/mariadb/server_audit-system-variables/server_audit_output_type: specify the log output type, which can be SYSLOG or FILEserver_audit_logging: start or close the audit server_audit_events: specify the type of event to be recorded, and multiple values (connect,query,table) separated by commas can be used. If query cache (query cache) is enabled, the query returns data directly from the query cache. There will be no table record server_audit_file_path: if server _ audit_output_type is FILE, use this variable to set the file to store the log. You can specify a directory, which is stored by default in the server_audit.log file of the data directory. Server_audit_file_rotate_size: limit the size of log files server_audit_file_rotations: specify the number of log files. If 0 log will never rotate server_audit_file_rotate_now: force log file rotation server_audit_incl_users: specify which users' activities will be recorded, connect will not be affected by this variable, this variable has higher priority than server_audit_excl_users server_audit_syslog_facility: default is LOG_USER, specify facilityserver_audit_syslog_ident: set ident As part of each syslog record server_audit_syslog_info: the specified info string will be added to the syslog record server_audit_syslog_priority: define the syslogd priorityserver_audit_excl_users for logging: the user behavior of the list will not be recorded and connect will not be affected by this setting server_audit_mode: identify the version for development testing

5. Unloading

Mysql > UNINSTALL PLUGIN server_audit;mysql > show variables like'% audit%';Empty set (0.00 sec)

To prevent the server_audit plug-in from being uninstalled, you need to add:

[mysqld]

Server_audit=FORCE_PLUS_PERMANENT

Restart MySQL takes effect

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.