Test the MySQL audit plug-in (mcafee and mariadb ).

Test the MySQL audit plug-in (mcafee and mariadb ).
Test server configuration: Dell R730, 24-core, 64 GB memory, and ssd disk. Centos version: 6.4; MySQL version: Community 5.6.12; test database size: 24 GB. Sysbench parameter: 64-thread 10 table, each table is initialized with 10 million data in advance, and read/write hybrid OLTP mode. And mysql run on the same machine. Test duration: 5 minutes/scenario. Plug-in OLTP test statistics: queries completed MED: read: 15377012 write: 4393432 other: 2196716 total: 21967160 transactions: 1098358 (3661.01 per sec.) Not Installed .) read/write requests: 19770444 (65898.21 per sec .) other operations: 2196716 (7322.02 per sec .) ignored errors: 0 (0.00 per sec .) reconnects: 0 (0.00 per sec .) official website of Mcafee plug-in: https://github.com/mcafee/mysql-audit/wikiuse: v1.0.9install install plugin audit soname 'liba Udit_plugin.so '; Enable set global audit_json_file = 1; Disable set global audit_json_file = 0; restart the mysql plug-in and Disable Logging. Run the uninstall plugin audit Command to Uninstall the plug-in. The uninstall audit plugin disabled error is returned. It is also found that Variable 'audit _ uninstall_plugin 'is a read only variable needs to add audit_uninstall_plugin = 1 in my. cnf and restart mysql. Run the uninstall plugin audit Command twice after the restart. You can UNINSTALL it. After the uninstallation is complete, you need. delete audit_uninstall_plugin = 1 in cnf; otherwise, the following ERROR will be reported during mysql startup: [ERROR]/data/mysql/bin/mysqld: unknown variable 'audit _ uninstall_plugin = 1' log format: json {"msg-type": "activity", "date": "1484795122970", "thread-id": "557", "query-id": "61687115 ", "user": "root", "priv_user": "root", "ip": "127.0.0.1", "cmd": "select", "objects ": [{"db": "sysbench_test", "name": "sbtest7", "obj_type": "TABLE"}], "query": "SELECT c FROM sbtest7 WHERE Id = 5015211 "} only records the OLTP test statistics: queries saved med: read: 8376872 write: 2393392 other: 1196696 total: 11966960 transactions: 598348 (1994.38 per sec.) logs with successful operations .) read/write requests: 10770264 (35898.81 per sec .) other operations: 1196696 (3988.76 per sec .) ignored errors: 0 (0.00 per sec .) reconnects: 0 (0.00 per sec .) mariadb plug-in official website address: https://mariadb.com/kb/en/mariadb/about-the-mariadb-audit-plugin/use region: 1.1.7 install plugin server_audit SONAME 'server _ audit. so '; Enable set global server_audit_logging = 1; set global server_audit_file_rotate_size = 1073741824; set global server_audit_file_rotations = 4; Disable set global server_audit_logging = 0; restart the mysql plug-in. However, all parameters are reset. You need to execute the required parameter configuration when you enable it again. Uninstall plugin server_audit; UNINSTALL the plug-in without restarting mysql. Log format: fixed text 20170119 10:39:19, localhost. localdomain, root, 127.0.0.1, 375, 8330400, QUERY, sysbench_test, 'select c FROM sbtest5 WHERE id = 100', 0 all operations will be recorded. SQL injection can be recorded. OLTP test statistics: queries saved med: read: 9098362 write: 2599532 other: 1299766 total: 12997660 transactions: 649883 (2166.16 per sec .) read/write requests: 11697894 (38990.84 per sec .) other operations: 1299766 (4332.32 per sec .) ignored errors: 0 (0.00 per sec .) reconnects: 0 (0.00 per sec .) conclusion: mcafee's audit plug-in: the performance is reduced by about 46%. To uninstall the plug-in, you need to restart mysql once. If the plug-in does not automatically scroll and you need to deploy a cleanup task separately, there may be risks that the disk space is insufficient due to a failed cleanup task. It is difficult to coordinate the pulling of logs to other servers for analysis and cleanup tasks, the cleanup task has coupling. Mariadb's audit plug-in: The Performance drops by about 41% and generates MB of logs. The performance is slightly better than that of mcafee plug-ins. Audit logs are automatically rolled. Easy to uninstall. In terms of compatibility, version 5.6.12 is not compatible with version 1.1.7 or later. If you use MySQL, the daemon will restart mysql infinitely. The official saying is that version 1.2.0 or later must be used in version MySQL5.6.17 or later. You must first test it before use. Percona's audit plug-in: not compatible with versions earlier than 5.6.17 and has not been tested yet.