Percona Server 审计日志 介绍

SHOW PLUGINS;
查看输入 是否有
复制

INSTALL PLUGIN audit_log SONAME 'audit_log.so';
SHOW PLUGINS;
| ROCKSDB_INDEX_FILE_MAP          | ACTIVE   | INFORMATION SCHEMA | ha_rocksdb.so | GPL     |
| ROCKSDB_LOCKS                   | ACTIVE   | INFORMATION SCHEMA | ha_rocksdb.so | GPL     |
| ROCKSDB_TRX                     | ACTIVE   | INFORMATION SCHEMA | ha_rocksdb.so | GPL     |
| ROCKSDB_DEADLOCK                | ACTIVE   | INFORMATION SCHEMA | ha_rocksdb.so | GPL     |
| audit_log                       | ACTIVE   | AUDIT              | audit_log.so  | GPL     |
+---------------------------------+----------+--------------------+---------------+---------+
复制

audit_log_include_accounts 和audit_log_include_commands 来控制用户以及 sql 命令 
如下:


@1  设置用户 可以多个用户
set global audit_log_include_accounts='root@%,root@localhost'; 
@2支持的sql 类型 


SELECT name FROM performance_schema.setup_instruments WHERE name LIKE "statement/sql/%" ORDER BY name;
 statement/sql/alter_db                        |
| statement/sql/alter_event                     |
| statement/sql/alter_function                  |
| statement/sql/alter_instance                  |
| statement/sql/alter_procedure                 |
| statement/sql/alter_resource_group            |
| statement/sql/alter_server                    |
| statement/sql/alter_table                     |
| statement/sql/alter_tablespace                |
| statement/sql/alter_user                      |
| statement/sql/alter_user_default_role         |
| statement/sql/analyze                         |
| statement/sql/assign_to_keycache              |
| statement/sql/begin                           |
| statement/sql/binlog           
.....




@3 设置 set、create database delete、insert、select、 都记录审计日志
SET GLOBAL audit_log_include_commands= 'set_option,create_db, delete,insert,select';


@4 执行select 语句 
mysql> select count(*) from customer1 ;
+----------+
| count(*) |
+----------+
|   300000 |
+----------+
1 row in set (0.19 sec)


审计日志的记录 
[root@zgs data]# tailf audit.log 
  COMMAND_CLASS="select"
  CONNECTION_ID="186"
  STATUS="0"
  SQLTEXT="select count(*) from customer1"
  USER="root[root] @  [192.168.1.6]"
  HOST=""
  OS_USER=""
  IP="192.168.1.6"
  DB=""
/>
复制