Operation of the mysql-5.7.17 audit plug-in for CentOS 7.2system
The following brings you about the operation of the CentOS 7.2system mysql-5.7.17 audit plug-in, if you are interested, let's take a look at this article. I believe it will be of some help to you after reading the operation of the CentOS 7.2system mysql-5.7.17 audit plug-in.
1. Let's take mysql-5.7.17 as an example and install a third-party plug-in to audit. Through many parties know that MySQL AUDIT Plugin is a MySQL security audit plug-in, provided by McAfee, the design emphasizes security and audit capabilities. Can be used as a stand-alone audit solution or configured for data transfer to external monitoring tools.
Download address of audit:
Https://bintray.com/mcafee/mysql-audit-plugin/release
two。 Prepare to install the audit plug-in
[root@~] unzip audit-plugin-mysql-5.7-1.1.2-694-linux-x86_64.zip
Archive: audit-plugin-mysql-5.7-1.1.2-694-linux-x86_64.zip
Creating: audit-plugin-mysql-5.7-1.1.2-694 /
Creating: audit-plugin-mysql-5.7-1.1.2-694/lib/
Inflating: audit-plugin-mysql-5.7-1.1.2-694/lib/libaudit_plugin.so
Inflating: audit-plugin-mysql-5.7-1.1.2-694/COPYING
Inflating: audit-plugin-mysql-5.7-1.1.2-694/THIRDPARTY.txt
Inflating: audit-plugin-mysql-5.7-1.1.2-694/README.txt
Creating: audit-plugin-mysql-5.7-1.1.2-694/utils/
Inflating: audit-plugin-mysql-5.7-1.1.2-694/utils/offset-extract.sh
3. Check the path where mysql installs the audit plug-in
Mysql > show global variables like 'plugin_dir'
+-- +
| | Variable_name | Value |
+-- +
| | plugin_dir | / data0/mysql/lib/plugin/ |
+-- +
1 row in set (0.00 sec)
4. Copy the plug-ins that need to be installed to the above specified path and grant executable permissions
[root@~] cd audit-plugin-mysql-5.7-1.1.2-694/lib
[root@lib] cp libaudit_plugin.so / data0/mysql/lib/plugin/
[root@~] cd / data0/mysql/lib/plugin/
[root@plugin] chmod axix libaudit_plugin.so
5. Once you have step 4, you can load the audit plug-in on the database
Mysql > install plugin audit soname 'libaudit_plugin.so'
Query OK, 0 rows affected (1.78 sec)
Mysql > flush privileges
Query OK, 0 rows affected (0.00 sec)
6. After loading the plug-in, check to see if the audit plug-in has been inserted into the database, and check the relevant plug-in version
Mysql > show global status like'% audit%'
+-+ +
| | Variable_name | Value |
+-+ +
| | Audit_protocol_version | 1.0 | |
| | Audit_version | 1.1.2-694 | |
+-+ +
2 rows in set (0.00 sec)
7. Turn on the audit function of the database
Mysql > set global audit_json_file=on
Query OK, 0 rows affected (0.00 sec)
8. View database information related to audit
Mysql > show global variables like'% audit%'
+-+ +
| | Variable_name | Value |
+-- +
| | audit_before_after | after |
| | audit_checksum |
| | audit_client_capabilities | OFF |
| | audit_delay_cmds |
| | audit_delay_ms | 0 | |
| | audit_force_record_logins | OFF |
| | audit_header_msg | ON |
| | audit_json_file | ON |
| | audit_json_file_bufsize | 1 | |
| | audit_json_file_flush | OFF |
| | audit_json_file_retry | 60 | |
| | audit_json_file_sync | 0 | |
| | audit_json_log_file | mysql-audit.json |
| | audit_json_socket | OFF |
| | audit_json_socket_name | / var/run/db-audit/mysql.audit__data0_mysql-data_3306 |
| | audit_json_socket_retry | 10 | |
| | audit_offsets |
| | audit_offsets_by_version | ON |
| | audit_password_masking_cmds | CREATE_USER,GRANT,SET_OPTION,SLAVE_START,CREATE_SERVER,ALTER_SERVER,CHANGE_MASTER,UPDATE |
| | audit_password_masking_regex | identified (?: /\ *. *?\ * / |\ s) *? by (?: /\ *. *?\ * / |\ s) *? (?: password)? (? /\ *. * / |\ s) *? ['| "] (?. *?) (?. *?) (?
