MySQL5.7安装server_audit审计

下载server_audit.so

可以从MARIADB官网下载
https://downloads.mariadb.org/mariadb/
或从我的资源中下载
https://download.csdn.net/download/qichangleixin/16633630
mariadb-10.5.9-linux-x86_64.tar.gz

查看插件安装目录

mysql -uroot -p

mysql> show global variables like 'plugin_dir';
+---------------+--------------------------+
| Variable_name | Value                    |
+---------------+--------------------------+
| plugin_dir    | /usr/lib64/mysql/plugin/ |
+---------------+--------------------------+
1 row in set (0.00 sec)

解压MARIADB获取SERVER_AUDIT.SO可用于MYSQL

/mariadb-10.4.18-linux-x86_64/lib/plugin 目录下server_audit.so拷贝到/usr/lib64/mysql/plugin

赋予权限SERVER_AUDIT.SO

chmod +x /usr/lib64/mysql/plugin/server_audit.so

写入配置文件

vim /etc/my.cnf

plugin_load_add = server_audit.so
#开启审计功能
server_audit_logging = ON
#防止插件被卸载
server_audit = FORCE_PLUS_PERMANENT
#是否强制切割审计日志
server_audit_file_rotate_now = ON
#定义切割审计日志的文件大小1073741824=1GB（单位K）
server_audit_file_rotate_size = 1073741824
#定义审计日志文件名
server_audit_file_path = server_audit.log
server_audit_events = connect,query,table,query_ddl,query_dml,query_dcl

重启MYSQL服务

service mysqld restart

查看SERVER_AUDIT.SO插件安装情况

mysql> show plugins;

server_audit.log默认存放于mysql的data目录下，查看日志存放目录

mysql> show global variables like 'datadir';

mysql> show global variables like 'datadir';
+---------------+-----------------+
| Variable_name | Value           |
+---------------+-----------------+
| datadir       | /var/lib/mysql/ |
+---------------+-----------------+
1 row in set (0.00 sec)

查看可以配置的一些信息

mysql> show variables like '%audit%';

官方介绍

https://mariadb.com/kb/en/mariadb-audit-plugin-options-and-system-variables/#comment_3279

https://www.freesion.com/article/39811000523/