MySQL Behavior audit

Plugin Source Address
Https://github.com/mcafee/mysql-audit
Plug-in Installation method
Https://github.com/mcafee/mysql-audit/wiki/Installation
Plug - ins
https://bintray.com/mcafee/mysql-audit-plugin/release/1.0.9-585

1. View MySQL Plugin storage directory
Mysql> SHOW GLOBAL VARIABLES like ' plugin_dir ';
+---------------+-----------------------------------+
| variable_name | Value |
+---------------+-----------------------------------+
| Plugin_dir | /usr/local/mysql/lib/plugin/|
+---------------+-----------------------------------+
1 row in Set (0.01 sec)

2. Copy libaudit_plugin.so to MySQL plugin directory
MV libaudit_plugin.so/usr/local/mysql/lib/plugin/
chmod a+x/usr/local/mysql/lib/plugin/*
Chown mysql:mysql/usr/local/mysql/lib/plugin/*

3, install the plug-in
Initial use of the online installation, but the installation failed
mysql> INSTALL PLUGIN AUDIT SONAME ' libaudit_plugin.so ';
ERROR 1524 (HY000): Plugin ' AUDIT ' is not loaded

Then use the Modify configuration and then restart the database, the official recommendation is to use the modified configuration method to install.
Note:on production systems, McAfee recommends using the Plugin-load option for installing the audit plugin.

Modify the My.cnf file to add the load audit plug-in code
Plugin-load=audit=libaudit_plugin.so
Audit_json_file=1
Audit_force_record_logins=1
Audit_json_file_sync=1
Audit_whitelist_users=test2,test1 #不记录行为的用户

Audit_whitelist_cmds =begin,commit,select #这个参数看需要要不要设, filter out the query

Restart database
/etc/init.d/mysql.server restart

[Email protected] mysql]# tail Mysql-audit.json
{"Msg-type": "Activity", "date": "1490176712103", "Thread-id": "3", "Query-id": "0", "User": "Root", "Priv_user": "Root", "Host": "localhost", "cmd": "Connect", "Query": "Connect"}
{"Msg-type": "Activity", "date": "1490176712106", "Thread-id": "3", "Query-id": "One", "User": "Root", "Priv_user": "Root" , "host": "localhost", "cmd": "Select", "Query": "SELECT @ @version_comment limit 1"}
{"Msg-type": "Activity", "date": "1490176724747", "Thread-id": "3", "Query-id": "A", "User": "Root", "Priv_user": "Root" , "host": "localhost", "cmd": "Select", "Query": "Select DATABASE ()"}
{"Msg-type": "Activity", "date": "1490176724748", "Thread-id": "3", "Query-id": "$", "user": "Root", "Priv_user": "Root" , "host": "localhost", "cmd": "Init db", "objects": [{"DB": "Test", "Obj_type": "DATABASE"}], "Query": "Init db"}
{"Msg-type": "Activity", "date": "1490176724754", "Thread-id": "3", "Query-id": "+", "User": "Root", "Priv_user": "Root" , "host": "localhost", "cmd": "Show_databases", "objects": [{"DB": "Information_schema", "name": "/tmp/#sql_a6c_0", "obj _type ":" TABLE "}]," Query ":" Show Databases "}
{"Msg-type": "Activity", "date": "1490176724769", "Thread-id": "3", "Query-id": "$", "user": "Root", "Priv_user": "Root" , "host": "localhost", "cmd": "Show_tables", "objects": [{"DB": "Information_schema", "name": "/tmp/#sql_a6c_0", "obj_ Type ":" TABLE "}]," Query ":" Show Tables "}
{"Msg-type": "Activity", "date": "1490176724771", "Thread-id": "3", "Query-id": "+", "User": "Root", "Priv_user": "Root" , "host": "localhost", "cmd": "Show_fields", "Query": "Show_fields"}
{"Msg-type": "Activity", "date": "1490176753954", "Thread-id": "3", "Query-id": "+", "User": "Root", "Priv_user": "Root" , "host": "localhost", "cmd": "Show_tables", "objects": [{"DB": "Information_schema", "name": "/tmp/#sql_a6c_0", "obj_ Type ":" TABLE "}]," Query ":" Show Tables "}
{"Msg-type": "Activity", "date": "1490176769225", "Thread-id": "3", "Query-id": "+", "User": "Root", "Priv_user": "Root" , "host": "localhost", "cmd": "Select", "Objects": [{"DB": "Test", "name": "T1", "Obj_type": "TABLE"}], "Query": "SELECT * from T1 "}
{"Msg-type": "Activity", "date": "1490176779812", "Thread-id": "3", "Query-id": "+", "User": "Root", "Priv_user": "Root" , "host": "localhost", "cmd": "Quit", "Query": "Quit"}

MySQL Behavior audit