MariaDB Audit Plugin - Location and Rotation of Logs - Source

Revision: 67001
User: Russell Dyer
Date: 2018-03-12 09:13

<<toc>>
Logs can be written to a separate file or to the system logs. If you prefer to have the logging separated from other system information, the value of the variable, [[mariadb-audit-plugin-system-variables/#server_audit_output_type|server_audit_output_type]] should be set to ##file##. Incidentally, ##file## is the only option on Windows systems.

You can force a rotation by enabling the [[mariadb-audit-plugin-system-variables/#server_audit_file_rotate_now|server_audit_file_rotate_now]] variable like so:
<<sql inline=false>>
SET GLOBAL server_audit_file_rotate_now = ON;
<</sql>>

===Separate log files
In addition to setting [[mariadb-audit-plugin-system-variables/#server_audit_output_type|server_audit_output_type]], you will have to provide the file path and name of the audit file. This is set in the variable, [[mariadb-audit-plugin-system-variables/#server_audit_file_path|server_audit_file_path]]. You can set the file size limit of the log file with the variable, [[mariadb-audit-plugin-system-variables/#server_audit_file_rotate_size|server_audit_file_rotate_size]].

So, if rotation is on and the log file has reached the size limit you set, a copy is created with a consecutive number as extension, the original file will be truncated to be used for the auditing again. To limit the number of log files created, set the variable, [[mariadb-audit-plugin-system-variables/#server_audit_file_rotations|server_audit_file_rotations]]. You can force log file rotation by setting the variable, [[mariadb-audit-plugin-system-variables/#server_audit_file_rotate_now|server_audit_file_rotate_now]] to a value of ##ON##. When the number of files permitted is reached, the oldest file will be overwritten. Below is an example of how the variables described above might be set in a server's configuration files:
<<code>>
[mysqld]
...
server_audit_file_rotate_now=ON 
server_audit_file_rotate_size=1000000 
server_audit_file_rotations=5
...
<</code>>

===System logs
For security reasons, it's better sometimes to use the system logs instead of a local file owned by the ##mysql## user. To do this, the value of [[mariadb-audit-plugin-system-variables/#server_audit_output_type|server_audit_output_type]] needs to be set to ##syslog##. Advanced configurations, such as using a remote ##syslogd## service, are part of the ##syslogd## configuration.

The variables, [[mariadb-audit-plugin-system-variables/#server_audit_syslog_ident|server_audit_syslog_ident]] and [[mariadb-audit-plugin-system-variables/#server_audit_syslog_info|server_audit_syslog_info]] can be used to identify a system log entry made by the audit plugin. If a remote ##syslogd## service is used for several MariaDB servers, these same variables are also used to identify the MariaDB server.

Below is an example of a system log entry taken from a server which had [[mariadb-audit-plugin-system-variables/#server_audit_syslog_ident|server_audit_syslog_ident]] set to the default value of ##mysql-server_auditing##, and [[mariadb-audit-plugin-system-variables/#server_audit_syslog_info|server_audit_syslog_info]] set to ##<prod1>##.
<<code>>
Aug 717:19:58localhostmysql-server_auditing: 
<prod1> localhost.localdomain,root,localhost,1,7, 
QUERY, mysql, 'SELECT * FROM user',0
<</code>>

Although the default values for [[mariadb-audit-plugin-system-variables/#server_audit_syslog_facility|server_audit_syslog_facility]] and [[mariadb-audit-plugin-system-variables/#server_audit_syslog_priority|server_audit_syslog_priority]] should be sufficient in most cases, they can be changed based on the definition in ##syslog.h## for the functions ##openlog()## and ##syslog()##.

Content reproduced on this site is the property of its respective owners, and this content is not reviewed in advance by MariaDB. The views, information and opinions expressed by this content do not necessarily represent those of MariaDB or any other party.

MariaDB Audit Plugin - Location and Rotation of Logs - Source

Products

Services

Pricing

Resources

About Us

Download MariaDB