MySQL审计日志动态安装mysql-audit
1. 查看 MYSQL 版本并找出审计对应版本：
[root@dbus1 ~]# mysqld -V
mysqld Ver 5.7.39 for Linux on x86_64 (MySQL Community Server (GPL))
[root@dbus1 ~]#
2. 查看审计日志对应版本：
打开地址： https://github.com/trellix-enterprise/mysql-audit/releases
v1.1.13 Latest
Added support for:
MySQL 64-bit 8.0.30
MySQL 64-bit 5.7.39, 5.7.38
MySQL 32-bit 5.7.39, 5.7.38
MariaDB 64-bit 10.7.5, 10.7.4, 10.7.3, 10.5.16, 10.2.44
MariaDB 32-bit 10.2.44
v1.1.12
Added support for:
MySQL 64-bit 8.0.28, 8.0.27, 8.0.26
MySQL 64-bit 5.7.37
MySQL 32-bit 5.7.37
MariaDB 64-bit 10.6.7, 10.6.5, 10.6.4, 10.6.3
MariaDB 64-bit 10.5.15, 10.4.24, 10.2.43
MariaDB 32-bit 10.2.43
3. 下载对应版本：
wget https://github.com/trellix-enterprise/mysql-audit/releases/download/v1.1.13/audit-plugin-mysql-5.7-1.1.13-1008-linux-x86_64.zip
4. 解压 文件：
[root@dbus1 ~]# cd /home/mysql
[root@dbus1 mysql]# unzip audit-plugin-mysql-5.7-1.1.13-1008-linux-x86_64.zip
[root@dbus1 mysql]# cd audit-plugin-mysql-5.7-1.1.13-1008
[root@dbus1 audit-plugin-mysql-5.7-1.1.13-1008]# ls
COPYING lib plugin-name.txt README.txt THIRDPARTY.txt utils
[root@dbus1 audit-plugin-mysql-5.7-1.1.13-1008]#
5. 查看 插件目录：
mysql> show variables like 'plugin_dir';
+---------------+--------------------------+
| Variable_name | Value |
+---------------+--------------------------+
| plugin_dir | /usr/lib64/mysql/plugin/ |
+---------------+--------------------------+
1 row in set (0.07 sec)
mysql>
6. 复制插件到MYSQL插件目录 并赋权：
[root@dbus1 ~]# cp /home/mysql/audit-plugin-mysql-5.7-1.1.13-1008/lib/libaudit_plugin.so /usr/lib64/mysql/plugin/
[root@dbus1 ~]# chown -R mysql:mysql /home/mysql/audit-mysql
7. 创建文件目录及审计文件：
/home/mysql/audit-mysql/mysql-audit.log
[root@dbus1 ~]# chown -R mysql:mysql /home/mysql/audit-mysql
8. 安装插件：
mysql> INSTALL PLUGIN audit SONAME 'libaudit_plugin.so';
9. 设置参数：
mysql> set global audit_json_file=1;
Query OK, 0 rows affected (0.00 sec)
mysql> set global audit_json_log_file='/home/mysql/audit-mysql/mysql-audit.log';
Query OK, 0 rows affected (0.00 sec)
mysql> set global audit_json_file_flush=on;
Query OK, 0 rows affected (0.00 sec)
# 只记录lmis和Insterface库操作
mysql> set global audit_record_objs='lmis.*,interface.*';
Query OK, 0 rows affected (0.00 sec)
mysql> set global audit_record_cmds='select,insert,delete,update,create,drop,alter,grant,truncate';
Query OK, 0 rows affected (0.00 sec)
# 审计日志缓冲区（最大256K）
mysql> set global audit_json_file_bufsize=64*1024;
Query OK, 0 rows affected (0.00 sec)
10.安装完成后查看相关变量及状态：
mysql>
mysql> show status like '%audit%';
+------------------------+-------------+
| Variable_name | Value |
+------------------------+-------------+
| Audit_protocol_version | 1.0 |
| Audit_version | 1.1.13-1008 |
+------------------------+-------------+
2 rows in set (0.02 sec)
mysql>
mysql> show plugins;
+----------------------------+----------+--------------------+----------------------+---------+
| Name | Status | Type | Library | License |
+----------------------------+----------+--------------------+----------------------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
| mysql_native_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| sha256_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| CSV | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MEMORY | ACTIVE | STORAGE ENGINE | NULL | GPL |
| InnoDB | ACTIVE | STORAGE ENGINE | NULL | GPL |
| INNODB_TRX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCKS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCK_WAITS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE_LRU | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_POOL_STATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_TEMP_TABLE_INFO | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_METRICS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DEFAULT_STOPWORD | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_BEING_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_CONFIG | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_CACHE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_TABLE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESTATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_INDEXES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_COLUMNS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FIELDS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN_COLS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESPACES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_DATAFILES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_VIRTUAL | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| MyISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MRG_MYISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| PERFORMANCE_SCHEMA | ACTIVE | STORAGE ENGINE | NULL | GPL |
| ARCHIVE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| BLACKHOLE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| FEDERATED | DISABLED | STORAGE ENGINE | NULL | GPL |
| partition | ACTIVE | STORAGE ENGINE | NULL | GPL |
| ngram | ACTIVE | FTPARSER | NULL | GPL |
| validate_password | ACTIVE | VALIDATE PASSWORD | validate_password.so | GPL |
| AUDIT | ACTIVE | AUDIT | libaudit_plugin.so | GPL |
+----------------------------+----------+--------------------+----------------------+---------+
46 rows in set (0.05 sec)
mysql>
更多推荐
6
0- 0
已为社区贡献1条内容
所有评论(0)