下载server_audit.so
可以从MARIADB官网下载
https://downloads.mariadb.org/mariadb/
或从我的资源中下载
https://download.csdn.net/download/qichangleixin/16633630
mariadb-10.5.9-linux-x86_64.tar.gz
查看插件安装目录
mysql -uroot -p
mysql> show global variables like 'plugin_dir';
+---------------+--------------------------+
| Variable_name | Value |
+---------------+--------------------------+
| plugin_dir | /usr/lib64/mysql/plugin/ |
+---------------+--------------------------+
1 row in set (0.00 sec)
解压MARIADB获取SERVER_AUDIT.SO可用于MYSQL
/mariadb-10.4.18-linux-x86_64/lib/plugin 目录下server_audit.so拷贝到/usr/lib64/mysql/plugin
赋予权限SERVER_AUDIT.SO
chmod +x /usr/lib64/mysql/plugin/server_audit.so
写入配置文件
vim /etc/my.cnf
plugin_load_add = server_audit.so
#开启审计功能
server_audit_logging = ON
#防止插件被卸载
server_audit = FORCE_PLUS_PERMANENT
#是否强制切割审计日志
server_audit_file_rotate_now = ON
#定义切割审计日志的文件大小1073741824=1GB(单位K)
server_audit_file_rotate_size = 1073741824
#定义审计日志文件名
server_audit_file_path = server_audit.log
server_audit_events = connect,query,table,query_ddl,query_dml,query_dcl
重启MYSQL服务
service mysqld restart
查看SERVER_AUDIT.SO插件安装情况
mysql> show plugins;
server_audit.log默认存放于mysql的data目录下,查看日志存放目录
mysql> show global variables like 'datadir';
mysql> show global variables like 'datadir';
+---------------+-----------------+
| Variable_name | Value |
+---------------+-----------------+
| datadir | /var/lib/mysql/ |
+---------------+-----------------+
1 row in set (0.00 sec)
查看可以配置的一些信息
mysql> show variables like '%audit%';
官方介绍
https://mariadb.com/kb/en/mariadb-audit-plugin-options-and-system-variables/#comment_3279
https://www.freesion.com/article/39811000523/