MySQL 安全 - 审计

mysql>SHOW GLOBAL VARIABLES LIKE 'plugin_dir';plugin+---------------+--------------------------+| Variable_name | Value                    |+---------------+--------------------------+| plugin_dir    | /usr/lib64/mysql/plugin/ |+---------------+--------------------------+cd  /usr/lib64/mysql/plugin/[root@localhost plugin]# ll -ld audit_log.so -rwxr-xr-x. 1 root root 69152 May 16 14:04 audit_log.so

INSTALL PLUGIN audit_log SONAME 'audit_log.so';SHOW PLUGINS;

show variables like '%audit%';+-----------------------------+------------------+| Variable_name               | Value            |+-----------------------------+------------------+| audit_log_buffer_size       | 1048576          || audit_log_exclude_accounts  | backup@%,xxx@% || audit_log_exclude_commands  |                  || audit_log_exclude_databases |                  || audit_log_file              | audit.log        || audit_log_flush             | OFF              || audit_log_format            | JSON             || audit_log_handler           | FILE             || audit_log_include_accounts  |                  || audit_log_include_commands  |                  || audit_log_include_databases |                  || audit_log_policy            | ALL              || audit_log_rotate_on_size    | 0                || audit_log_rotations         | 0                || audit_log_strategy          | SYNCHRONOUS      || audit_log_syslog_facility   | LOG_USER         || audit_log_syslog_ident      | percona-audit    || audit_log_syslog_priority   | LOG_INFO         |+-----------------------------+------------------+

vim /etc/my.cnfaudit_log_file   = audit.logaudit_log_format = JSON     文件格式为jsonaudit_log_exclude_accounts = 'backup@192.168.1.%,xxxx@192.168.1.%'   排除用户记录audit_log_strategy = SYNCHRONOUS    直接登录文件，刷新并同步每个事件systemctl restart mysqld 重启生效