CentOS 7 离线安装MySQL审计插件

命令行

cd /data/tools

sz mariadb-10.2.38-linux-x86_64.tar.gz

tar -zxvf mariadb-10.2.38-linux-x86_64.tar.gz

install lib/plugin/server_audit.so /usr/lib64/mysql/plugin/

mysql -uroot -p'root'

install plugin server_audit SONAME 'server_audit.so';

show variables like "%audit%";

exit

## 配置audit永久有效
mkdir -p /data/logs/logs_audit
chmod -R 777 /data/logs/logs_audit

vi /etc/my.cnf

# audit log                         											# 注释以下为audit配置
server_audit_logging=ON             											# 随MySQL启动自动加载
# server_audit_events=connect,table,query_ddl,query_dcl,query_dml_no_select    	# 指定要记录SQL语句，除查询语句外
server_audit_events=connect,query,table,query_ddl,query_dml,query_dcl,query_dml_no_select
server_audit_file_rotate_now=ON            										# 开启日志轮转
server_audit_file_rotate_size=100000000        									# 日志文件达到100M就轮转
server_audit_file_path=/data/logs/logs_audit/server_audit.log        			# 审计日志文件存储路径

## 验证
show variables like "%audit%";

## 重启MySQL
systemctl restart mysqld.service

## 验证日志是否打印了SQL语句
mysql -uroot -p'root'
use xxx_db;
select * from tb_user;
exit

tail -200 /data/logs/logs_audit/server_audit.log

参考

https://www.jianshu.com/p/45b37a73e286

相关截图

查询SQL

查询SQL-审计日志

登出-审计日志

登录-审计日志