MARIADB 10.1.xx comes with database audit plug-in, directly on the operation process

MariaDB 10.1.20 latest version using your own plugin

192.168.1.91 Open Database Audit

192.168.1.94 remote access, execution DDL,DML,DCL fine-grained audit

Early in the morning to the company to do testing, database first installed, directly on the operation process

[Email protected]/]# mysql-uroot-p

Enter Password:

Welcome to the MariaDB Monitor. Commands End With; or \g.

Your MariaDB Connection ID is 4

Server VERSION:10.1.20-MARIADB MariaDB Server

Copyright (c), Oracle, MariaDB Corporation Ab and others.

Type ' help ', ' or ' \h ' for help. Type ' \c ' to clear the current input statement.

MariaDB [(None)]> show databases;

+--------------------+

| Database |

+--------------------+

| Information_schema |

| MySQL |

| Performance_schema |

| Test |

+--------------------+

4 rows in Set (0.02 sec)

MariaDB [(none)]> use test

Database changed

MariaDB [test]> Show tables;

Empty Set (0.00 sec)

MariaDB [test]>

MariaDB [test]> Show variables like ' Plugin_dir ';

+---------------+------------------------------+

| variable_name | Value |

+---------------+------------------------------+

| Plugin_dir | /usr/local/mysql/lib/plugin/|

+---------------+------------------------------+

1 row in Set (0.01 sec)

MariaDB [test]> Install plugin server_audit SONAME ' server_audit.so ';

Query OK, 0 rows affected (0.05 sec)

MariaDB [test]> Show variables like ' server% ';

+-------------------------------+-----------------------+

| variable_name | Value |

+-------------------------------+-----------------------+

|                       server_audit_events | |

|                       Server_audit_excl_users | |

| Server_audit_file_path | Server_audit.log |

| Server_audit_file_rotate_now | OFF |

| Server_audit_file_rotate_size | 1000000 |

| server_audit_file_rotations | 9 |

|                       Server_audit_incl_users | |

| server_audit_logging | OFF |

| Server_audit_mode | 0 |

| Server_audit_output_type | File |

| Server_audit_query_log_limit | 1024 |

| server_audit_syslog_facility | Log_user |

| server_audit_syslog_ident | mysql-server_auditing |

|                       Server_audit_syslog_info | |

| server_audit_syslog_priority | Log_info |

| server_id | 100 |

+-------------------------------+-----------------------+

Rows in Set (0.00 sec)

MariaDB [test]> set global server_audit_logging=on;

Query OK, 0 rows Affected (0.00 sec)

MariaDB [test]> Set global server_audit_events= ' QUERY_DDL '; --fine-grained audit OK

Query OK, 0 rows Affected (0.00 sec)

MariaDB [test]> Set global server_audit_events= ' QUERY_DML ';

Query OK, 0 rows Affected (0.00 sec)

MariaDB [test]> Set global server_audit_events= ' QUERY_DCL ';

Query OK, 0 rows Affected (0.00 sec)

MariaDB [test]> Grant Select on * * to [e-mail protected] '% ' identified by ' roidba_r ';

Query OK, 0 rows Affected (0.00 sec)

View audit status of logs

[[email protected] mysql]# ls

aria_log.00000001 ib_buffer_pool ib_logfile1 multi-master.info mysql91.pid server_audit.log

Aria_log_control Ib_logfile0 ibdata1 mysql/performance_schema/test/

[Email protected] mysql]# tail-f Server_audit.log

20161227 13:49:55,mysql91,root,localhost,4,12,query,test, ' Set global Server_audit_logging=on ', 0

20161227 13:54:37,mysql91,roidba,192.168.1.94,6,21,query,test, ' CREATE TABLE t1 (id int) ', 0

20161227 13:56:28,mysql91,roidba,192.168.1.94,6,25,query,test, ' insert into T1 values (2) ', 0

20161227 13:56:51,mysql91,roidba,192.168.1.94,6,26,query,test, ' update T1 set id=2 where Id=1 ', 0

20161227 14:16:36,mysql91,root,localhost,4,32,query,test, ' Grant SELECT on * * to [e-mail protected]\ '%\ ' identified by * * ', 0

The specific parameter adjustment, the parameter meaning everybody needs oneself on the official website to view,

I always insisted that the best documents were the official documents.

This article is from the "ROIDBA" blog, make sure to keep this source http://roidba.blog.51cto.com/12318731/1886393

MARIADB 10.1.xx comes with database audit plug-in, directly on the operation process