Shulou(Shulou.com)06/01 Report--

1. To enable SQL audit function for database security, choose the plug-in of MariaDB Audit Plugin (Oracle MySQL 5.7.24)

Mysql > show variables like 'version' +-+-+ | Variable_name | Value | +-+-+ | version | 5.7.24-log | +-+-+ 1 row in set (0.00 sec) mysql > show variables like 'plugin_dir' +-+-- + | Variable_name | Value | +-+-+ | plugin_dir | / usr/lib64/mysql/plugin/ | + -+-+ 1 row in set (0.01 sec)

2. Download the plug-in and decompress it

Wget https://downloads.mariadb.com/MariaDB/mariadb-5.5.66/bintar-linux-x86_64/mariadb-5.5.66-linux-x86_64.tar.gztar-zxvf mariadb-5.5.66-linux-x86_64.tar.gz cp mariadb-5.5.66-linux-x86_64/lib/plugin/server_audit.so / usr/lib64/mysql/plugin/chmod 755 / usr/lib64/mysql/plugin/server_audit.so

3. Install the plug-in and enable it

Mysql > install plugin server_audit SONAME 'server_audit.so';Query OK, 0 rows affected (0.00 sec) mysql > show variables like'% audit%' +-+ | Variable_name | Value | +-- +- -+ | server_audit_events | server_audit_excl_users | server_audit_file_path | server_audit.log | | server_audit_file_rotate_now | OFF | | server_audit_file_rotate_size | 1000000 | | Server_audit_file_rotations | 9 | server_audit_incl_users | | server_audit_loc_info | | server_audit_logging | OFF | | server_audit_mode | 1 | server_audit_output_type | | file | | server_audit_query_log_limit | 1024 | | server_audit_syslog_facility | LOG_USER | | server_audit_syslog_ident | mysql-server_auditing | | server_audit_syslog_info | | server_audit_syslog_priority | LOG_INFO | +-| -+-+ 16 rows in set (0.00 sec) mysql > set global server_audit_logging=1 Query OK, 0 rows affected (0.00 sec)

4. Add startup to configuration file

Vi / etc/ my.cnf[mysqld] server_audit_logging=on

5. View the log

Mysql > show variables like 'datadir' +-+-+ | Variable_name | Value | +-+-+ | datadir | / u01/data/ | +-+-+ 1 row in set (0.00 sec) tail-f / U01/data/server_audit.log 20191203 17:15:03 Mysql_node01,test_user,192.168.1.2,14016,573201,QUERY,test,'SHOW GLOBAL STATUS',0

6. Configuration instructions

Server_audit_logging: turn audit on or off

Server_audit_events: specifies the type of event to be logged. Multiple values can be separated by commas (connect,query,table). The default is empty to represent the audit of all events.

Server_audit_incl_users: specify which users' activities will be recorded, and audit all users by default. This variable has higher priority than server_audit_excl_users.

Server_audit_excl_users: specify which user behaviors are not recorded

Server_audit_output_type: specifies the log output type, which can be SYSLOG or FILE, and output to the audit file by default

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.