MySQL 5.7.24 installation of the MySQL Audit plug-in
1)。 Go to the website (https://bintray.com/version/files/mcafee/mysql-audit-plugin/release/1.1.7-805) download plug-in audit-plugin-mysql-5.7-1.1.7-805-linux-x86_64.zip
2)。 Upload to the MySQL machine and extract:
# unzip audit-plugin-mysql-5.7-1.1.7-805-linux-x86_64.zip
Archive: audit-plugin-mysql-5.7-1.1.7-805-linux-x86_64.zip
Creating: audit-plugin-mysql-5.7-1.1.7-805 /
Creating: audit-plugin-mysql-5.7-1.1.7-805/lib/
Inflating: audit-plugin-mysql-5.7-1.1.7-805/lib/libaudit_plugin.so
Inflating: audit-plugin-mysql-5.7-1.1.7-805/COPYING
Inflating: audit-plugin-mysql-5.7-1.1.7-805/THIRDPARTY.txt
Inflating: audit-plugin-mysql-5.7-1.1.7-805/README.txt
Inflating: audit-plugin-mysql-5.7-1.1.7-805/plugin-name.txt
Creating: audit-plugin-mysql-5.7-1.1.7-805/utils/
Inflating: audit-plugin-mysql-5.7-1.1.7-805/utils/offset-extract.sh
3)。 Check the plug-in directory for mysql:
Mysql > show global variables like 'plugin_dir'
+-- +
| | Variable_name | Value |
+-- +
| | plugin_dir | / usr/local/mysql-5.7.24/lib/plugin/ |
+-- +
1 row in set (0.01 sec)
4)。 Copy libaudit_plugin.so to the mysql plug-in directory:
# cp lib/libaudit_plugin.so / usr/local/mysql-5.7.24/lib/plugin/
5)。 Install the libaudit_plugin.so plug-in:
Mysql > install plugin audit soname 'libaudit_plugin.so'
Query OK, 0 rows affected (3.97 sec)
6)。 Enable the audit function:
Mysql > set global audit_json_file=1
Query OK, 0 rows affected (0.00 sec)
7)。 Generate the audit log in the data file directory of mysql:
Mysql > show variables like 'datadir'
+-+ +
| | Variable_name | Value |
+-+ +
| | datadir | / home/mysql/data/ |
+-+ +
1 row in set (0.01 sec)
8)。 View the contents of the audit log:
# less / home/mysql/data/mysql-audit.json
{"msg-type": "header", "date": "1550816633651", "audit-version": "1.1.7-8055"," audit-protocol-version ":" 1.0", "hostname": "test2", "mysql-version": "5.7.24-log", "mysql-program": "/ usr/local/mysql-5.7.24/bin/mysqld", "mysql-socket": "/ tmp/mysql.sock", "mysql-port": "3306" "server_pid": "6485"}
{"msg-type": "activity", "date": "1550816633651", "thread-id": "126897", "query-id": "3356369", "user": "root", "priv_user": "root", "ip": "" host ":" localhost "," connect_attrs ": {" _ os ":" linux-glibc2.12 "," _ client_name ":" libmysql "," _ pid ":" 13108 "," _ client_version ":" 5.7.24 " "_ platform": "x86, 64", "program_name": "mysql"}, "pid": "13108", "os_user": "root", "appname": "mysql", "status": "0", "cmd": "set_option", "query": "set global audit_json_file=1"}
{"msg-type": "activity", "date": "1550816634816", "thread-id": "126952", "query-id": "0", "user": "monitor", "priv_user": "", "ip": "192.168.140.52", "host": "192.168.140.52", "connect_attrs": {"_ os": "Linux", "_ client_name": "libmariadb", "_ pid": "21686" "_ client_version": "2.3.1", "_ platform": "x86164"," program_name ":" proxysql_monitor "}," status ":" 1045 "," cmd ":" Failed Login "," query ":" Failed Login "}
{"msg-type": "activity", "date": "1550816634816", "thread-id": "126952", "query-id": "0", "user": "monitor", "priv_user": "", "ip": "192.168.140.52", "host": "192.168.140.52", "connect_attrs": {"_ os": "Linux", "_ client_name": "libmariadb", "_ pid": "21686" "_ client_version": "2.3.1", "_ platform": "x86164"," program_name ":" proxysql_monitor "}," cmd ":" Connect "," query ":" Connect "}
. ..
. ..
. ..
. ..
9)。 View the loaded audit plug-in:
Mysql > select * from INFORMATION_SCHEMA.PLUGINS where PLUGIN_NAME like'% AUDIT%'
+- -+
| | PLUGIN_NAME | PLUGIN_VERSION | PLUGIN_STATUS | PLUGIN_TYPE | PLUGIN_TYPE_VERSION | PLUGIN_LIBRARY | PLUGIN_LIBRARY_VERSION | PLUGIN_AUTHOR | PLUGIN_DESCRIPTION | PLUGIN_LICENSE | LOAD_OPTION |
+- -+
| | AUDIT | 1.0 | ACTIVE | AUDIT | 4.1 | libaudit_plugin.so | 1.6 | McAfee Inc | AUDIT plugin, creates a file mysql-audit.log to log activity | GPL | ON |
+- -+
1 row in set (0.00 sec)
10)。 View the parameters related to MySQL audit:
Mysql > show global variables like'% audit%'
+- - - -- +
| | Variable_name | Value |
+- - - -- +
| | audit_before_after | after |
| | audit_checksum |
| | audit_client_capabilities | OFF |
| | audit_delay_cmds |
| | audit_delay_ms | 0 | |
| | audit_force_record_logins | OFF |
| | audit_header_msg | ON |
| | audit_json_file | ON |
| | audit_json_file_bufsize | 1 | |
| | audit_json_file_flush | OFF |
| | audit_json_file_retry | 60 | |
| | audit_json_file_sync | 0 | |
| | audit_json_log_file | mysql-audit.json |
| | audit_json_socket | OFF |
| | audit_json_socket_name | / var/run/db-audit/mysql.audit__home_mysql_data_3306 |
| | audit_json_socket_retry | 10 | |
| | audit_json_socket_write_timeout | 1000 | |
| | audit_offsets |
| | audit_offsets_by_version | ON |
| | audit_password_masking_cmds | CREATE_USER,GRANT,SET_OPTION,SLAVE_START,CREATE_SERVER,ALTER_SERVER,CHANGE_MASTER,UPDATE |
| | audit_password_masking_regex | identified (?: /\ *. *?\ * / |\ s) *? by (?: /\ *. *?\ * / |\ s) *? (?: password)? (? /\ *. * / |\ s) *? ['| "] (?. *?) (?. *?) (?
