mysql 5.7 审计_mysql 5.7 安装SQL审计

1、为了数据库安全准备开启SQL审计功能，选用MariaDB Audit Plugin的插件(Oracle MySQL 5.7.24)

mysql> show variables like 'version';

+---------------+------------+

| Variable_name | Value |

+---------------+------------+

| version | 5.7.24-log |

+---------------+------------+

1 row in set (0.00 sec)

mysql> show variables like 'plugin_dir';

+---------------+--------------------------+

| Variable_name | Value |

+---------------+--------------------------+

| plugin_dir | /usr/lib64/mysql/plugin/ |

+---------------+--------------------------+

1 row in set (0.01 sec)

2、下载插件并解压

wget https://downloads.mariadb.com/MariaDB/mariadb-5.5.66/bintar-linux-x86_64/mariadb-5.5.66-linux-x86_64.tar.gz

tar -zxvf mariadb-5.5.66-linux-x86_64.tar.gz

cp mariadb-5.5.66-linux-x86_64/lib/plugin/server_audit.so /usr/lib64/mysql/plugin/

chmod 755 /usr/lib64/mysql/plugin/server_audit.so

3、安装插件并启用

mysql> install plugin server_audit SONAME 'server_audit.so';

Query OK, 0 rows affected (0.00 sec)

mysql> show variables like '%audit%';

+-------------------------------+-----------------------+

| Variable_name | Value |

+-------------------------------+-----------------------+

| server_audit_events | |

| server_audit_excl_users | |

| server_audit_file_path | server_audit.log |

| server_audit_file_rotate_now | OFF |

| server_audit_file_rotate_size | 1000000 |

| server_audit_file_rotations | 9 |

| server_audit_incl_users | |

| server_audit_loc_info | |

| server_audit_logging | OFF |

| server_audit_mode | 1 |

| server_audit_output_type | file |

| server_audit_query_log_limit | 1024 |

| server_audit_syslog_facility | LOG_USER |

| server_audit_syslog_ident | mysql-server_auditing |

| server_audit_syslog_info | |

| server_audit_syslog_priority | LOG_INFO |

+-------------------------------+-----------------------+

16 rows in set (0.00 sec)

mysql> set global server_audit_logging=1;

Query OK, 0 rows affected (0.00 sec)

4、配置文件添加启动

vi /etc/my.cnf

[mysqld]

server_audit_logging=on

5、查看日志

mysql> show variables like 'datadir';

+---------------+------------+

| Variable_name | Value |

+---------------+------------+

| datadir | /u01/data/ |

+---------------+------------+

1 row in set (0.00 sec)

tail -f /u01/data/server_audit.log

20191203 17:15:03,mysql_node01,test_user,192.168.1.2,14016,573201,QUERY,test,'SHOW GLOBAL STATUS',0

6、配置说明

server_audit_logging：启动或关闭审计

server_audit_events：指定记录事件的类型，可以用逗号分隔的多个值(connect,query,table) ，默认为空代表审计所有事件。

server_audit_incl_users：指定哪些用户的活动将记录，默认审计所有用户，该变量比server_audit_excl_users优先级高

server_audit_excl_users：指定哪些用户行为不记录

server_audit_output_type：指定日志输出类型，可为SYSLOG或FILE，缺省输出至审计文件