Shulou(Shulou.com)06/01 Report--

1)。 Go to the website (https://bintray.com/version/files/mcafee/mysql-audit-plugin/release/1.1.7-805) download plug-in audit-plugin-mysql-5.7-1.1.7-805-linux-x86_64.zip

2)。 Upload to the MySQL machine and extract:

# unzip audit-plugin-mysql-5.7-1.1.7-805-linux-x86_64.zip

Archive: audit-plugin-mysql-5.7-1.1.7-805-linux-x86_64.zip

Creating: audit-plugin-mysql-5.7-1.1.7-805 /

Creating: audit-plugin-mysql-5.7-1.1.7-805/lib/

Inflating: audit-plugin-mysql-5.7-1.1.7-805/lib/libaudit_plugin.so

Inflating: audit-plugin-mysql-5.7-1.1.7-805/COPYING

Inflating: audit-plugin-mysql-5.7-1.1.7-805/THIRDPARTY.txt

Inflating: audit-plugin-mysql-5.7-1.1.7-805/README.txt

Inflating: audit-plugin-mysql-5.7-1.1.7-805/plugin-name.txt

Creating: audit-plugin-mysql-5.7-1.1.7-805/utils/

Inflating: audit-plugin-mysql-5.7-1.1.7-805/utils/offset-extract.sh

3)。 Check the plug-in directory for mysql:

Mysql > show global variables like 'plugin_dir'

+-- +

| | Variable_name | Value |

+-- +

| | plugin_dir | / usr/local/mysql-5.7.24/lib/plugin/ |

+-- +

1 row in set (0.01 sec)

4)。 Copy libaudit_plugin.so to the mysql plug-in directory:

# cp lib/libaudit_plugin.so / usr/local/mysql-5.7.24/lib/plugin/

5)。 Install the libaudit_plugin.so plug-in:

Mysql > install plugin audit soname 'libaudit_plugin.so'

Query OK, 0 rows affected (3.97 sec)

6)。 Enable the audit function:

Mysql > set global audit_json_file=1

Query OK, 0 rows affected (0.00 sec)

7)。 Generate the audit log in the data file directory of mysql:

Mysql > show variables like 'datadir'

+-+ +

| | Variable_name | Value |

+-+ +

| | datadir | / home/mysql/data/ |

+-+ +

1 row in set (0.01 sec)

8)。 View the contents of the audit log:

# less / home/mysql/data/mysql-audit.json

{"msg-type": "header", "date": "1550816633651", "audit-version": "1.1.7-8055"," audit-protocol-version ":" 1.0", "hostname": "test2", "mysql-version": "5.7.24-log", "mysql-program": "/ usr/local/mysql-5.7.24/bin/mysqld", "mysql-socket": "/ tmp/mysql.sock", "mysql-port": "3306" "server_pid": "6485"}

{"msg-type": "activity", "date": "1550816633651", "thread-id": "126897", "query-id": "3356369", "user": "root", "priv_user": "root", "ip": "" host ":" localhost "," connect_attrs ": {" _ os ":" linux-glibc2.12 "," _ client_name ":" libmysql "," _ pid ":" 13108 "," _ client_version ":" 5.7.24 " "_ platform": "x86, 64", "program_name": "mysql"}, "pid": "13108", "os_user": "root", "appname": "mysql", "status": "0", "cmd": "set_option", "query": "set global audit_json_file=1"}

{"msg-type": "activity", "date": "1550816634816", "thread-id": "126952", "query-id": "0", "user": "monitor", "priv_user": "", "ip": "192.168.140.52", "host": "192.168.140.52", "connect_attrs": {"_ os": "Linux", "_ client_name": "libmariadb", "_ pid": "21686" "_ client_version": "2.3.1", "_ platform": "x86164"," program_name ":" proxysql_monitor "}," status ":" 1045 "," cmd ":" Failed Login "," query ":" Failed Login "}

{"msg-type": "activity", "date": "1550816634816", "thread-id": "126952", "query-id": "0", "user": "monitor", "priv_user": "", "ip": "192.168.140.52", "host": "192.168.140.52", "connect_attrs": {"_ os": "Linux", "_ client_name": "libmariadb", "_ pid": "21686" "_ client_version": "2.3.1", "_ platform": "x86164"," program_name ":" proxysql_monitor "}," cmd ":" Connect "," query ":" Connect "}

. ..

. ..

. ..

. ..

9)。 View the loaded audit plug-in:

Mysql > select * from INFORMATION_SCHEMA.PLUGINS where PLUGIN_NAME like'% AUDIT%'

+- -+

| | PLUGIN_NAME | PLUGIN_VERSION | PLUGIN_STATUS | PLUGIN_TYPE | PLUGIN_TYPE_VERSION | PLUGIN_LIBRARY | PLUGIN_LIBRARY_VERSION | PLUGIN_AUTHOR | PLUGIN_DESCRIPTION | PLUGIN_LICENSE | LOAD_OPTION |

+- -+

| | AUDIT | 1.0 | ACTIVE | AUDIT | 4.1 | libaudit_plugin.so | 1.6 | McAfee Inc | AUDIT plugin, creates a file mysql-audit.log to log activity | GPL | ON |

+- -+

1 row in set (0.00 sec)

10)。 View the parameters related to MySQL audit:

Mysql > show global variables like'% audit%'

+- - - -- +

| | Variable_name | Value |

+- - - -- +

| | audit_before_after | after |

| | audit_checksum |

| | audit_client_capabilities | OFF |

| | audit_delay_cmds |

| | audit_delay_ms | 0 | |

| | audit_force_record_logins | OFF |

| | audit_header_msg | ON |

| | audit_json_file | ON |

| | audit_json_file_bufsize | 1 | |

| | audit_json_file_flush | OFF |

| | audit_json_file_retry | 60 | |

| | audit_json_file_sync | 0 | |

| | audit_json_log_file | mysql-audit.json |

| | audit_json_socket | OFF |

| | audit_json_socket_name | / var/run/db-audit/mysql.audit__home_mysql_data_3306 |

| | audit_json_socket_retry | 10 | |

| | audit_json_socket_write_timeout | 1000 | |

| | audit_offsets |

| | audit_offsets_by_version | ON |

| | audit_password_masking_cmds | CREATE_USER,GRANT,SET_OPTION,SLAVE_START,CREATE_SERVER,ALTER_SERVER,CHANGE_MASTER,UPDATE |

| | audit_password_masking_regex | identified (?: /\ *. *?\ * / |\ s) *? by (?: /\ *. *?\ * / |\ s) *? (?: password)? (? /\ *. * / |\ s) *? ['| "] (?. *?) (?. *?) (?

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.