背景：

當數據業務上或者其他的特殊情況時可能會進行審計，以便知道數據庫當時所做的操作，今天給大家帶來percona的審計插件

Percona Audit Log Plugin提供對特定服務器上執行的連接和查詢活動的監視和記錄。 有關活動的信息將存儲在XML日志文件中，其中每個事件將具有其NAME字段，其自己的唯一RECORD_ID字段和TIMESTAMP字段。 此實現是MySQL Enterprise Audit Log Plugin的替代審計日志插件生成以下事件的日志：Audit - Audit事件表示審計日志記錄已開始或已完成。 記錄開始時NAME字段為Audit，日志記錄完成時為NoAudit。 審計記錄還包括服務器版本和命令行參數。

"NAME"="Audit"

"RECORD"="1_2014-04-29T09:29:40"

"TIMESTAMP"="2014-04-29T09:29:40 UTC"

"MYSQL_VERSION"="5.6.17-65.0-655.trusty"

"STARTUP_OPTIONS"="--basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib/mysql/plugin --user=mysql --log-error=/var/log/mysql/error.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/run/mysqld/mysqld.sock --port=3306"

"OS_VERSION"="x86_64-debian-linux-gnu",

/>

Connect/Disconnect - Connect record event will have NAME field Connect when user logged in or login failed, or Quit when connection is closed. Additional fields for this event are CONNECTION_ID, STATUS, USER, PRIV_USER, OS_LOGIN, PROXY_USER, HOST, and IP. STATUS will be 0 for successful logins and non-zero for failed logins.

Example of the Disconnect event:

"NAME"="Quit"

"RECORD"="24_2014-04-29T09:29:40"

"TIMESTAMP"="2014-04-29T10:20:13 UTC"

"CONNECTION_ID"="49"

"STATUS"="0"

"USER"=""

"PRIV_USER"=""

"OS_LOGIN"=""

"PROXY_USER"=""

"HOST"=""

"IP"=""

"DB"=""

/>

1,安裝：

審核日志插件隨Percona Server一起提供，但默認情況下不會安裝。要啟用該插件，您必須運行以下命令

INSTALL PLUGIN audit_log SONAME 'audit_log.so';

驗證插件是否安裝成功

SHOW PLUGINS;

+--------------------------------+----------+--------------------+--------------+---------+

| Name | Status | Type | Library | License |

+--------------------------------+----------+--------------------+--------------+---------+

...

| audit_log | ACTIVE | AUDIT | audit_log.so | GPL |

+--------------------------------+----------+--------------------+--------------+---------+

2，日志格式：

審核日志插件支持四種日志格式：OLD，NEW，JSON和CSV。 OLD和NEW格式基于XML，前者將日志記錄屬性輸出為XML屬性，后者輸出為XML標記。 記錄的信息在所有四種格式中都是相同的。 日志格式選擇由audit_log_format變量控制。

Quit

10902_2014-04-28T11:02:54

2014-04-28T11:02:59 UTC

36

0

3，實戰：

以下示例顯示添加將受監控的用戶

mysql> SET GLOBAL audit_log_include_accounts = 'user1@localhost,root@localhost';

Query OK, 0 rows affected (0.00 sec)

If you you try to add users to both include and exclude lists server will show you the following error:

mysql> SET GLOBAL audit_log_exclude_accounts = 'user1@localhost,root@localhost';

ERROR 1231 (42000): Variable 'audit_log_exclude_accounts' can't be set to the value of 'user1@localhost,root@localhost'

To switch from filtering by included user list to the excluded one or back, first set the currently active filtering variable to NULL:

mysql> SET GLOBAL audit_log_include_accounts = NULL;

Query OK, 0 rows affected (0.00 sec)

mysql> SET GLOBAL audit_log_exclude_accounts = 'user1@localhost,root@localhost';

Query OK, 0 rows affected (0.00 sec)

mysql> SET GLOBAL audit_log_exclude_accounts = "'user'@'host'";

Query OK, 0 rows affected (0.00 sec)

mysql> SET GLOBAL audit_log_exclude_accounts = '''user''@''host''';

Query OK, 0 rows affected (0.00 sec)

mysql> SET GLOBAL audit_log_exclude_accounts = '\'user\'@\'host\'';

Query OK, 0 rows affected (0.00 sec)

To see what users are currently in the on the list you can run:

mysql> SELECT @@audit_log_exclude_accounts;

+------------------------------+

| @@audit_log_exclude_accounts |

+------------------------------+

| 'user'@'host' |

+------------------------------+

1 row in set (0.00 sec)

--備注：監控的用戶名必須和mysql.user里用戶名一致，不然不生效

NAME="Connect"

RECORD="4971917_2016-08-22T09:09:10"

TIMESTAMP="2016-08-22T09:12:21 UTC"

CONNECTION_ID="6"

STATUS="0"

USER="user1" ;; this is a 'user' part of account in 5.7

PRIV_USER="user1"

OS_LOGIN=""

PROXY_USER=""

HOST="localhost" ;; this is a 'host' part of account in 5.7

IP=""

DB=""

/>

過渡掉user1(排除user1)

SET GLOBAL audit_log_exclude_accounts = 'user1@%';

總結：

1，數據庫審計是一個非常實用和重要的功能

2，一般情況下不會開啟這個功能，因為對性能消耗比較大

3，percona提供了這個功能，原生的Mysql社區版是沒有的，只有企業版才有

總結

以上是生活随笔為你收集整理的mysql audit log.so_Percona Audit Log Plugin（mysql 审计）的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。