MariaDB Audit Plugin con Percona Server 5.6.24-72.2
tar zxvf server_audit-1.2.0.tar.gz
server_audit-1.2.0/
server_audit-1.2.0/linux-32_debug/
server_audit-1.2.0/linux-32_debug/server_audit.so
server_audit-1.2.0/linux-32/
server_audit-1.2.0/linux-32/server_audit.so
server_audit-1.2.0/linux-64_debug/
server_audit-1.2.0/linux-64_debug/server_audit.so
server_audit-1.2.0/windows-32/
server_audit-1.2.0/windows-32/server_audit.dll
server_audit-1.2.0/windows-64_debug/
server_audit-1.2.0/windows-64_debug/server_audit.dll
server_audit-1.2.0/linux-64/
server_audit-1.2.0/linux-64/server_audit.so
server_audit-1.2.0/windows-64/
server_audit-1.2.0/windows-64/server_audit.dll
server_audit-1.2.0/windows-32_debug/
server_audit-1.2.0/windows-32_debug/server_audit.dll
tomas@binlogic:~$ mysql -uroot -pbinlogic
Warning: Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 46
Server version: 5.6.24-72.2 Percona Server (GPL), Release 72.2, Revision 8d0f85b
Copyright (c) 2009-2015 Percona LLC and/or its affiliates
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show global variables like 'plugin_dir';
+---------------+------------------------+
| Variable_name | Value |
+---------------+------------------------+
| plugin_dir | /usr/lib/mysql/plugin/ |
+---------------+------------------------+
1 row in set (0.00 sec)
mysql> exit
Bye
tomas@binlogic:~$ ls
Desktop Documents Downloads examples.desktop Music Pictures Public server_audit-1.2.0 server_audit-1.2.0.tar.gz Templates Videos
tomas@binlogic:~$ cd server_audit-1.2.0/
tomas@binlogic:~/server_audit-1.2.0$ ls
linux-32 linux-32_debug linux-64 linux-64_debug windows-32 windows-32_debug windows-64 windows-64_debug
tomas@binlogic:~/server_audit-1.2.0$ cd linux-64
tomas@binlogic:~/server_audit-1.2.0/linux-64$ ls
server_audit.so
tomas@binlogic:~/server_audit-1.2.0/linux-64$ cp -R server_audit.so /usr/lib/mysql/plugin/
cp: cannot create regular file ‘/usr/lib/mysql/plugin/server_audit.so’: Permission denied
tomas@binlogic:~/server_audit-1.2.0/linux-64$ sudo cp -R server_audit.so /usr/lib/mysql/plugin/
tomas@binlogic:~/server_audit-1.2.0/linux-64$ mysql -uroot -pbinlogic
Warning: Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 47
Server version: 5.6.24-72.2 Percona Server (GPL), Release 72.2, Revision 8d0f85b
Copyright (c) 2009-2015 Percona LLC and/or its affiliates
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> install plugin server_audit SONAME 'server_audit.so';
Query OK, 0 rows affected (0.34 sec)
mysql> select * from information_schema.plugins;
+-----------------------------+----------------+---------------+--------------------+---------------------+-----------------+------------------------+--------------------------------------------+----------------------------------------------------------------------------+----------------+-------------+
| PLUGIN_NAME | PLUGIN_VERSION | PLUGIN_STATUS | PLUGIN_TYPE | PLUGIN_TYPE_VERSION | PLUGIN_LIBRARY | PLUGIN_LIBRARY_VERSION | PLUGIN_AUTHOR | PLUGIN_DESCRIPTION | PLUGIN_LICENSE | LOAD_OPTION |
+-----------------------------+----------------+---------------+--------------------+---------------------+-----------------+------------------------+--------------------------------------------+----------------------------------------------------------------------------+----------------+-------------+
| binlog | 1.0 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | MySQL AB | This is a pseudo storage engine to represent the binlog in a transaction | GPL | FORCE |
| mysql_native_password | 1.0 | ACTIVE | AUTHENTICATION | 1.0 | NULL | NULL | R.J.Silk, Sergei Golubchik | Native MySQL authentication | GPL | FORCE |
| mysql_old_password | 1.0 | ACTIVE | AUTHENTICATION | 1.0 | NULL | NULL | R.J.Silk, Sergei Golubchik | Old MySQL-4.0 authentication | GPL | FORCE |
| sha256_password | 1.0 | ACTIVE | AUTHENTICATION | 1.0 | NULL | NULL | Oracle | SHA256 password authentication | GPL | FORCE |
| MRG_MYISAM | 1.0 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | MySQL AB | Collection of identical MyISAM tables | GPL | FORCE |
| CSV | 1.0 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | Brian Aker, MySQL AB | CSV storage engine | GPL | FORCE |
| MyISAM | 1.0 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | MySQL AB | MyISAM storage engine | GPL | FORCE |
| MEMORY | 1.0 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | MySQL AB | Hash based, stored in memory, useful for temporary tables | GPL | FORCE |
| BLACKHOLE | 1.0 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | MySQL AB | /dev/null storage engine (anything you write to it disappears) | GPL | ON |
| PERFORMANCE_SCHEMA | 0.1 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | Marc Alff, Oracle | Performance Schema | GPL | FORCE |
| FEDERATED | 1.0 | DISABLED | STORAGE ENGINE | 50624.0 | NULL | NULL | Patrick Galbraith and Brian Aker, MySQL AB | Federated MySQL storage engine | GPL | OFF |
| InnoDB | 5.6 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | Oracle Corporation | Percona-XtraDB, Supports transactions, row-level locking, and foreign keys | GPL | ON |
| XTRADB_READ_VIEW | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Percona Inc. | InnoDB Read View information | GPL | ON |
| XTRADB_INTERNAL_HASH_TABLES | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Percona Inc. | InnoDB internal hash tables information | GPL | ON |
| XTRADB_RSEG | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Percona Inc. | InnoDB rollback segment information | GPL | ON |
| INNODB_TRX | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB transactions | GPL | ON |
| INNODB_LOCKS | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB conflicting locks | GPL | ON |
| INNODB_LOCK_WAITS | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB which lock is blocking which | GPL | ON |
| INNODB_CMP | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | Statistics for the InnoDB compression | GPL | ON |
| INNODB_CMP_RESET | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | Statistics for the InnoDB compression; reset cumulated counts | GPL | ON |
| INNODB_CMPMEM | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | Statistics for the InnoDB compressed buffer pool | GPL | ON |
| INNODB_CMPMEM_RESET | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | Statistics for the InnoDB compressed buffer pool; reset cumulated counts | GPL | ON |
| INNODB_CMP_PER_INDEX | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | Statistics for the InnoDB compression (per index) | GPL | ON |
| INNODB_CMP_PER_INDEX_RESET | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | Statistics for the InnoDB compression (per index); reset cumulated counts | GPL | ON |
| INNODB_BUFFER_PAGE | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB Buffer Page Information | GPL | ON |
| INNODB_BUFFER_PAGE_LRU | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB Buffer Page in LRU | GPL | ON |
| INNODB_BUFFER_POOL_STATS | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB Buffer Pool Statistics Information | GPL | ON |
| INNODB_METRICS | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB Metrics Info | GPL | ON |
| INNODB_FT_DEFAULT_STOPWORD | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | Default stopword list for InnDB Full Text Search | GPL | ON |
| INNODB_FT_DELETED | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | INNODB AUXILIARY FTS DELETED TABLE | GPL | ON |
| INNODB_FT_BEING_DELETED | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | INNODB AUXILIARY FTS BEING DELETED TABLE | GPL | ON |
| INNODB_FT_CONFIG | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | INNODB AUXILIARY FTS CONFIG TABLE | GPL | ON |
| INNODB_FT_INDEX_CACHE | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | INNODB AUXILIARY FTS INDEX CACHED | GPL | ON |
| INNODB_FT_INDEX_TABLE | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | INNODB AUXILIARY FTS INDEX TABLE | GPL | ON |
| INNODB_SYS_TABLES | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB SYS_TABLES | GPL | ON |
| INNODB_SYS_TABLESTATS | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB SYS_TABLESTATS | GPL | ON |
| INNODB_SYS_INDEXES | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB SYS_INDEXES | GPL | ON |
| INNODB_SYS_COLUMNS | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB SYS_COLUMNS | GPL | ON |
| INNODB_SYS_FIELDS | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB SYS_FIELDS | GPL | ON |
| INNODB_SYS_FOREIGN | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB SYS_FOREIGN | GPL | ON |
| INNODB_SYS_FOREIGN_COLS | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB SYS_FOREIGN_COLS | GPL | ON |
| INNODB_SYS_TABLESPACES | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB SYS_TABLESPACES | GPL | ON |
| INNODB_SYS_DATAFILES | 5.6 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Oracle Corporation | InnoDB SYS_DATAFILES | GPL | ON |
| INNODB_CHANGED_PAGES | 1.0 | ACTIVE | INFORMATION SCHEMA | 50624.0 | NULL | NULL | Percona | InnoDB CHANGED_PAGES table | GPL | ON |
| ARCHIVE | 3.0 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | Brian Aker, MySQL AB | Archive storage engine | GPL | ON |
| partition | 1.0 | ACTIVE | STORAGE ENGINE | 50624.0 | NULL | NULL | Mikael Ronstrom, MySQL AB | Partition Storage Engine Helper | GPL | ON |
| SERVER_AUDIT | 1.2 | ACTIVE | AUDIT | 3.2 | server_audit.so | 1.3 | Alexey Botchkov (MariaDB Corporation) | Audit the server activity | GPL | ON |
+-----------------------------+----------------+---------------+--------------------+---------------------+-----------------+------------------------+--------------------------------------------+----------------------------------------------------------------------------+----------------+-------------+
47 rows in set (0.10 sec)
mysql> set global server_audit_events='CONNECT,QUERY,TABLE';
Query OK, 0 rows affected (0.03 sec)
mysql> SHOW GLOBAL VARIABLES LIKE 'server_audit%';
+-------------------------------+-----------------------+
| Variable_name | Value |
+-------------------------------+-----------------------+
| server_audit_events | CONNECT,QUERY,TABLE |
| server_audit_excl_users | |
| server_audit_file_path | server_audit.log |
| server_audit_file_rotate_now | OFF |
| server_audit_file_rotate_size | 1000000 |
| server_audit_file_rotations | 9 |
| server_audit_incl_users | |
| server_audit_logging | OFF |
| server_audit_mode | 1 |
| server_audit_output_type | file |
| server_audit_syslog_facility | LOG_USER |
| server_audit_syslog_ident | mysql-server_auditing |
| server_audit_syslog_info | |
| server_audit_syslog_priority | LOG_INFO |
+-------------------------------+-----------------------+
14 rows in set (0.04 sec)
mysql> set global server_audit_logging=ON
-> ;
Query OK, 0 rows affected (0.03 sec)
mysql> SHOW GLOBAL VARIABLES LIKE 'server_audit%';
+-------------------------------+-----------------------+
| Variable_name | Value |
+-------------------------------+-----------------------+
| server_audit_events | CONNECT,QUERY,TABLE |
| server_audit_excl_users | |
| server_audit_file_path | server_audit.log |
| server_audit_file_rotate_now | OFF |
| server_audit_file_rotate_size | 1000000 |
| server_audit_file_rotations | 9 |
| server_audit_incl_users | |
| server_audit_logging | ON |
| server_audit_mode | 1 |
| server_audit_output_type | file |
| server_audit_syslog_facility | LOG_USER |
| server_audit_syslog_ident | mysql-server_auditing |
| server_audit_syslog_info | |
| server_audit_syslog_priority | LOG_INFO |
+-------------------------------+-----------------------+
14 rows in set (0.00 sec)
mysql> select version();
+-------------+
| version() |
+-------------+
| 5.6.24-72.2 |
+-------------+
1 row in set (0.06 sec)
mysql>
root@binlogic:/var/lib/mysql# ls
auto.cnf debian-5.6.flag ibdata1 ib_logfile0 ib_logfile1 mysql mysql_upgrade_info performance_schema server_audit.log test
root@binlogic:/var/lib/mysql#
root@binlogic:/var/lib/mysql# tail -f server_audit.log
20150601 14:44:29,binlogic,root,localhost,47,5,QUERY,,'set global server_audit_logging=ON',0
20150601 14:44:31,binlogic,root,localhost,47,6,QUERY,,'SHOW GLOBAL VARIABLES LIKE \'server_audit%\'',0
20150601 14:45:45,binlogic,root,localhost,47,7,QUERY,,'select version()',0
20150601 14:46:00,binlogic,root,localhost,47,0,DISCONNECT,,,0
