SERVER_AUDIT plugin
It's purpose is to log server's activity.
Installation
The 'server_audit.so' should be copied to the proper directory. Then:
MariaDB [test]> INSTALL PLUGIN server_audit SONAME 'server_audit.so'; Query OK, 0 rows affected (0.00 sec)
Log content
There are 3 types of log records.
CONNECTION inform about connected/disconnected users
QUERY queries issued and their results
TABLE which tables were affected by query execution
Variables
That plugin defines a number of variables shaping the way it works.
| Variable | Description |
|---|---|
| server_audit_output_type |
Specifies the desired output type. Can be SYSLOG, FILE or NULL.
example: SET GLOBAL server_audit_output_type=file
file: log recods will be saved into the rotating log file. Setting output to 'file' actually creates the file, so the variable 'server_audit_file_path' has to be properly set at the moment. syslog: log records will be sent to the local syslogd daemon with the standard <syslog.h> API. null: log records won't be sent anywhere at all.
| server_audit_logging |
Enables/disables the logging. Expected values are ON/OFF.
example: SET GLOBAL server_audit_logging=on
| server_audit_events |
If set it specifies the set of types of events to log.
Can be CONNECT, QUERY and TABLE.
example: SET GLOBAL server_audit_events='connect, query'
| server_audit_file_path |
When the 'server_audit_output_type=file' it sets the path to the log file.
| server_audit_file_rotate_size |
When the 'server_audit_output_type=file' it limits the size of the log file. Reaching that limit turns on the rotation - current log file is renamed as 'file_path.1'. Empty log file created as 'file_path' to log into it.
| server_audit_rotations |
When the 'server_audit_output_type=file' it specifies the number of rotations to save.
| server_audit_rotate |
When the 'server_audit_output_type=file' user can force the log file rotation by setting this variable.
| server_audit_incl_users |
If not empty, it contains the list of users whose activity will be logged.
example: SET GLOBAL server_audit_incl_users='user_foo, user_bar'
CONNECT records aren't affected by this variable - they are logged always.
| server_audit_excl_users |
If not empty, it contains the list of users whose activity will NOT be logged.
example: SET GLOBAL server_audit_excl_users='user_foo, user_bar'
CONNECT records aren't affected by this variable - they are logged always.
