MARIADB Audit Log Deployment

MARIADB audit logs and MySQL audit logs are used in the form of plug-ins.
Currently MySQL Enterprise Edition supports audit log function, Percona company plug-in can replace the plugin (Network Understanding MySQL Community Edition can use Percona Audit plugin, I have not yet experimental testing. )
This experiment starts the audit log based on MARIADB.
Version 1.mariadb: mariadb10.1.19 The audit log plugin is included in the official downloaded binary package.
2. See if the database installs plugins:
SHOW VARIABLES like '%plugin_dir% ';

看到此数据库已安装审计插件，卸载插件重新安装。

3. Uninstalling plugins

MariaDB [(none)]> UNINSTALL PLUGIN server_audit;ERROR 1702 (HY000): Plugin ‘server_audit‘ is force_plus_permanent and can not be unloaded

Uninstall plugin error, need to modify parameters.

Server_audit=force_plus_permanent

parameter prevents the plug-in parameter from being deleted. In the experiment, the DB can be restarted, and the actual production requires careful operation.

Vi/etc/my.cnf

#+ #audit
#plugin_load =server_audit
#server_audit_events =CONNECT,QUERY_DML,QUERY_DDL
#server_audit =force_plus_permanent
#server_audit_file_rotate_size = 128M
#server_audit_logging = On
#server_audit_file_path =/data01/mysql/log3306/server_audit.log
#sysdate_is_now = 1

To restart MySQL:
Uninstall succeeded.
MariaDB [(None)]> UnINSTALL PLUGIN Server_audit;
ERROR 1305 (42000): PLUGIN Server_audit does not exist
MariaDB [(None)]> show variables like '%audit% ';
Empty Set (0.00 sec)

4. Install the plugin:

MariaDB [(None)]> INSTALL PLUGIN server_audit SONAME ' libaudit_plugin.so ';
ERROR 1127 (HY000): Can ' t find Symbol ' server_audit ' in library

Installation Error:
Cause not found, restore the MY.CNF profile comment and restart MySQL.
Plugin_load=server_audit
Server_audit_events=connect,query_dml,query_ddl
Server_audit=force_plus_permanent
Server_audit_file_rotate_size = 128M
Server_audit_logging = On
Server_audit_file_path=/data01/mysql/log3306/server_audit.log
Sysdate_is_now = 1

Found to install again:
MariaDB [(None)]> INSTALL PLUGIN server_audit SONAME ' libaudit_plugin.so ';
ERROR 1968 (HY000): Plugin ' Server_audit ' already installed
MariaDB [(None)]> INSTALL PLUGIN server_audit SONAME ' libaudit_plugin.so ';
ERROR 1968 (HY000): Plugin ' Server_audit ' already installed

Now, it's horrible. The problem is that if you do not comment on the configuration file, you cannot stop Server_audit
+---------+------+----------------------------------------------------+
| Level | Code | Message |
+---------+------+----------------------------------------------------+
| Warning | 1620 | Plugin is busy and would be uninstalled on shutdown |
+---------+------+----------------------------------------------------+

Comment out installation not found: Can ' t find Symbol ' server_audit ' in library

5. Error Resolution:
Cause: The syntax for the installation is incorrect.
After commenting out the parameters of the audit log, restart MySQL

安装审计插件：

MariaDB [(None)]> show variables like '%audit% ';
Empty Set (0.00 sec)

MariaDB [(None)]> INSTALL PLUGIN server_audit SONAME ' server_audit.so ';
Query OK, 0 rows affected (0.01 sec)

MariaDB [(None)]> show variables like '%audit% ';
+-------------------------------+-----------------------+
| variable_name | Value |
+-------------------------------+-----------------------+
| server_audit_events | |
| Server_audit_excl_users | |
| Server_audit_file_path | Server_audit.log |
| Server_audit_file_rotate_now | OFF |
| Server_audit_file_rotate_size | 1000000 |
| server_audit_file_rotations | 9 |
| Server_audit_incl_users | |
| server_audit_logging | OFF |
| Server_audit_mode | 0 |
| Server_audit_output_type | File |
| Server_audit_query_log_limit | 1024 |
| server_audit_syslog_facility | Log_user |
| server_audit_syslog_ident | mysql-server_auditing |
| Server_audit_syslog_info | |
| server_audit_syslog_priority | Log_info |
+-------------------------------+-----------------------+
Rows in Set (0.01 sec)

At this time the audit log parameters are empty, you can set the global dynamic parameters to take effect, here in order to restart the MySQL is still in effect, the author used to modify the MY.CNF parameters to configure audit log parameters, that is, cancel the logoff parameters.

Plugin_load=server_audit
Server_audit_events=connect,query_dml,query_ddl
Server_audit=force_plus_permanent
Server_audit_file_rotate_size = 128M
Server_audit_logging = On
Server_audit_file_path=/data01/mysql/log3306/server_audit.log
Sysdate_is_now = 1

Restart MySQL, installation completed, we must not be as careless as the author, the article is more chaotic, hope readers cautious reference.

Note: INSTALL PLUGIN audit_log SONAME ' audit_log.so '; Install audit log statements for MySQL.

MARIADB Audit Log Deployment