mysql 审计日志_Ubuntu下rsyslog集中收集mysql审计日志

服务端

1、安装最新版本rsyslog

sudo apt-get install software-properties-common python-software-properties

sudo add-apt-repository ppa:adiscon/v8-stable

sudo apt-get update

sudo apt-get install rsyslog

2、配置目录存储mysql审计日志

vim /etc/rsyslog.d/50-default.conf

# add: define logfiles

$template Mysql-audit,"/var/log/remote_log/%app-name%/%hostname%_%fromhost-ip%_log_%app-name%_%$YEAR%-%$MONTH%-%$DAY%.log"

$template Remote,"/var/log/remote_log/%hostname%_%fromhost-ip%/log_%app-name%_%$YEAR%-%$MONTH%-%$DAY%.log"

# Log all messages to the dynamically formed file.

:app-name,isequal,"mysql-audit" ?Mysql-audit

:fromhost-ip, !isequal, "127.0.0.1" ?Remote

& stop

3、安装MySQL以及rsyslog-mysql模块，

apt-get install rsyslog-mysql mysql-server -y #安装过程中会自动创建表

4、配置/etc/rsyslog.d/50-default.confÿ