MariaDB Audit Plugin con Percona Server 5.6.24-72.2

tar zxvf server_audit-1.2.0.tar.gz 
server_audit-1.2.0/
server_audit-1.2.0/linux-32_debug/
server_audit-1.2.0/linux-32_debug/server_audit.so
server_audit-1.2.0/linux-32/
server_audit-1.2.0/linux-32/server_audit.so
server_audit-1.2.0/linux-64_debug/
server_audit-1.2.0/linux-64_debug/server_audit.so
server_audit-1.2.0/windows-32/
server_audit-1.2.0/windows-32/server_audit.dll
server_audit-1.2.0/windows-64_debug/
server_audit-1.2.0/windows-64_debug/server_audit.dll
server_audit-1.2.0/linux-64/
server_audit-1.2.0/linux-64/server_audit.so
server_audit-1.2.0/windows-64/
server_audit-1.2.0/windows-64/server_audit.dll
server_audit-1.2.0/windows-32_debug/
server_audit-1.2.0/windows-32_debug/server_audit.dll
tomas@binlogic:~$ mysql -uroot -pbinlogic
Warning: Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 46
Server version: 5.6.24-72.2 Percona Server (GPL), Release 72.2, Revision 8d0f85b

Copyright (c) 2009-2015 Percona LLC and/or its affiliates
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show global variables like 'plugin_dir';
+---------------+------------------------+
| Variable_name | Value                  |
+---------------+------------------------+
| plugin_dir    | /usr/lib/mysql/plugin/ |
+---------------+------------------------+
1 row in set (0.00 sec)

mysql> exit
Bye
tomas@binlogic:~$ ls
Desktop  Documents  Downloads  examples.desktop  Music  Pictures  Public  server_audit-1.2.0  server_audit-1.2.0.tar.gz  Templates  Videos
tomas@binlogic:~$ cd server_audit-1.2.0/
tomas@binlogic:~/server_audit-1.2.0$ ls
linux-32  linux-32_debug  linux-64  linux-64_debug  windows-32  windows-32_debug  windows-64  windows-64_debug
tomas@binlogic:~/server_audit-1.2.0$ cd linux-64
tomas@binlogic:~/server_audit-1.2.0/linux-64$ ls
server_audit.so
tomas@binlogic:~/server_audit-1.2.0/linux-64$ cp -R server_audit.so /usr/lib/mysql/plugin/
cp: cannot create regular file ‘/usr/lib/mysql/plugin/server_audit.so’: Permission denied
tomas@binlogic:~/server_audit-1.2.0/linux-64$ sudo cp -R server_audit.so /usr/lib/mysql/plugin/
tomas@binlogic:~/server_audit-1.2.0/linux-64$ mysql -uroot -pbinlogic
Warning: Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 47
Server version: 5.6.24-72.2 Percona Server (GPL), Release 72.2, Revision 8d0f85b

Copyright (c) 2009-2015 Percona LLC and/or its affiliates
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> install plugin server_audit SONAME 'server_audit.so';
Query OK, 0 rows affected (0.34 sec)

mysql> select * from information_schema.plugins;
+-----------------------------+----------------+---------------+--------------------+---------------------+-----------------+------------------------+--------------------------------------------+----------------------------------------------------------------------------+----------------+-------------+
| PLUGIN_NAME                 | PLUGIN_VERSION | PLUGIN_STATUS | PLUGIN_TYPE        | PLUGIN_TYPE_VERSION | PLUGIN_LIBRARY  | PLUGIN_LIBRARY_VERSION | PLUGIN_AUTHOR                              | PLUGIN_DESCRIPTION                                                         | PLUGIN_LICENSE | LOAD_OPTION |
+-----------------------------+----------------+---------------+--------------------+---------------------+-----------------+------------------------+--------------------------------------------+----------------------------------------------------------------------------+----------------+-------------+
| binlog                      | 1.0            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | MySQL AB                                   | This is a pseudo storage engine to represent the binlog in a transaction   | GPL            | FORCE       |
| mysql_native_password       | 1.0            | ACTIVE        | AUTHENTICATION     | 1.0                 | NULL            | NULL                   | R.J.Silk, Sergei Golubchik                 | Native MySQL authentication                                                | GPL            | FORCE       |
| mysql_old_password          | 1.0            | ACTIVE        | AUTHENTICATION     | 1.0                 | NULL            | NULL                   | R.J.Silk, Sergei Golubchik                 | Old MySQL-4.0 authentication                                               | GPL            | FORCE       |
| sha256_password             | 1.0            | ACTIVE        | AUTHENTICATION     | 1.0                 | NULL            | NULL                   | Oracle                                     | SHA256 password authentication                                             | GPL            | FORCE       |
| MRG_MYISAM                  | 1.0            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | MySQL AB                                   | Collection of identical MyISAM tables                                      | GPL            | FORCE       |
| CSV                         | 1.0            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | Brian Aker, MySQL AB                       | CSV storage engine                                                         | GPL            | FORCE       |
| MyISAM                      | 1.0            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | MySQL AB                                   | MyISAM storage engine                                                      | GPL            | FORCE       |
| MEMORY                      | 1.0            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | MySQL AB                                   | Hash based, stored in memory, useful for temporary tables                  | GPL            | FORCE       |
| BLACKHOLE                   | 1.0            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | MySQL AB                                   | /dev/null storage engine (anything you write to it disappears)             | GPL            | ON          |
| PERFORMANCE_SCHEMA          | 0.1            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | Marc Alff, Oracle                          | Performance Schema                                                         | GPL            | FORCE       |
| FEDERATED                   | 1.0            | DISABLED      | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | Patrick Galbraith and Brian Aker, MySQL AB | Federated MySQL storage engine                                             | GPL            | OFF         |
| InnoDB                      | 5.6            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | Percona-XtraDB, Supports transactions, row-level locking, and foreign keys | GPL            | ON          |
| XTRADB_READ_VIEW            | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Percona Inc.                               | InnoDB Read View information                                               | GPL            | ON          |
| XTRADB_INTERNAL_HASH_TABLES | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Percona Inc.                               | InnoDB internal hash tables information                                    | GPL            | ON          |
| XTRADB_RSEG                 | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Percona Inc.                               | InnoDB rollback segment information                                        | GPL            | ON          |
| INNODB_TRX                  | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB transactions                                                        | GPL            | ON          |
| INNODB_LOCKS                | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB conflicting locks                                                   | GPL            | ON          |
| INNODB_LOCK_WAITS           | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB which lock is blocking which                                        | GPL            | ON          |
| INNODB_CMP                  | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | Statistics for the InnoDB compression                                      | GPL            | ON          |
| INNODB_CMP_RESET            | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | Statistics for the InnoDB compression; reset cumulated counts              | GPL            | ON          |
| INNODB_CMPMEM               | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | Statistics for the InnoDB compressed buffer pool                           | GPL            | ON          |
| INNODB_CMPMEM_RESET         | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | Statistics for the InnoDB compressed buffer pool; reset cumulated counts   | GPL            | ON          |
| INNODB_CMP_PER_INDEX        | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | Statistics for the InnoDB compression (per index)                          | GPL            | ON          |
| INNODB_CMP_PER_INDEX_RESET  | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | Statistics for the InnoDB compression (per index); reset cumulated counts  | GPL            | ON          |
| INNODB_BUFFER_PAGE          | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB Buffer Page Information                                             | GPL            | ON          |
| INNODB_BUFFER_PAGE_LRU      | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB Buffer Page in LRU                                                  | GPL            | ON          |
| INNODB_BUFFER_POOL_STATS    | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB Buffer Pool Statistics Information                                  | GPL            | ON          |
| INNODB_METRICS              | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB Metrics Info                                                        | GPL            | ON          |
| INNODB_FT_DEFAULT_STOPWORD  | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | Default stopword list for InnDB Full Text Search                           | GPL            | ON          |
| INNODB_FT_DELETED           | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | INNODB AUXILIARY FTS DELETED TABLE                                         | GPL            | ON          |
| INNODB_FT_BEING_DELETED     | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | INNODB AUXILIARY FTS BEING DELETED TABLE                                   | GPL            | ON          |
| INNODB_FT_CONFIG            | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | INNODB AUXILIARY FTS CONFIG TABLE                                          | GPL            | ON          |
| INNODB_FT_INDEX_CACHE       | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | INNODB AUXILIARY FTS INDEX CACHED                                          | GPL            | ON          |
| INNODB_FT_INDEX_TABLE       | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | INNODB AUXILIARY FTS INDEX TABLE                                           | GPL            | ON          |
| INNODB_SYS_TABLES           | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB SYS_TABLES                                                          | GPL            | ON          |
| INNODB_SYS_TABLESTATS       | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB SYS_TABLESTATS                                                      | GPL            | ON          |
| INNODB_SYS_INDEXES          | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB SYS_INDEXES                                                         | GPL            | ON          |
| INNODB_SYS_COLUMNS          | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB SYS_COLUMNS                                                         | GPL            | ON          |
| INNODB_SYS_FIELDS           | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB SYS_FIELDS                                                          | GPL            | ON          |
| INNODB_SYS_FOREIGN          | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB SYS_FOREIGN                                                         | GPL            | ON          |
| INNODB_SYS_FOREIGN_COLS     | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB SYS_FOREIGN_COLS                                                    | GPL            | ON          |
| INNODB_SYS_TABLESPACES      | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB SYS_TABLESPACES                                                     | GPL            | ON          |
| INNODB_SYS_DATAFILES        | 5.6            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Oracle Corporation                         | InnoDB SYS_DATAFILES                                                       | GPL            | ON          |
| INNODB_CHANGED_PAGES        | 1.0            | ACTIVE        | INFORMATION SCHEMA | 50624.0             | NULL            | NULL                   | Percona                                    | InnoDB CHANGED_PAGES table                                                 | GPL            | ON          |
| ARCHIVE                     | 3.0            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | Brian Aker, MySQL AB                       | Archive storage engine                                                     | GPL            | ON          |
| partition                   | 1.0            | ACTIVE        | STORAGE ENGINE     | 50624.0             | NULL            | NULL                   | Mikael Ronstrom, MySQL AB                  | Partition Storage Engine Helper                                            | GPL            | ON          |
| SERVER_AUDIT                | 1.2            | ACTIVE        | AUDIT              | 3.2                 | server_audit.so | 1.3                    |  Alexey Botchkov (MariaDB Corporation)     | Audit the server activity                                                  | GPL            | ON          |
+-----------------------------+----------------+---------------+--------------------+---------------------+-----------------+------------------------+--------------------------------------------+----------------------------------------------------------------------------+----------------+-------------+
47 rows in set (0.10 sec)

mysql> set global server_audit_events='CONNECT,QUERY,TABLE';
Query OK, 0 rows affected (0.03 sec)

mysql> SHOW GLOBAL VARIABLES LIKE 'server_audit%';
+-------------------------------+-----------------------+
| Variable_name                 | Value                 |
+-------------------------------+-----------------------+
| server_audit_events           | CONNECT,QUERY,TABLE   |
| server_audit_excl_users       |                       |
| server_audit_file_path        | server_audit.log      |
| server_audit_file_rotate_now  | OFF                   |
| server_audit_file_rotate_size | 1000000               |
| server_audit_file_rotations   | 9                     |
| server_audit_incl_users       |                       |
| server_audit_logging          | OFF                   |
| server_audit_mode             | 1                     |
| server_audit_output_type      | file                  |
| server_audit_syslog_facility  | LOG_USER              |
| server_audit_syslog_ident     | mysql-server_auditing |
| server_audit_syslog_info      |                       |
| server_audit_syslog_priority  | LOG_INFO              |
+-------------------------------+-----------------------+
14 rows in set (0.04 sec)

mysql> set global server_audit_logging=ON
    -> ;
Query OK, 0 rows affected (0.03 sec)

mysql> SHOW GLOBAL VARIABLES LIKE 'server_audit%';
+-------------------------------+-----------------------+
| Variable_name                 | Value                 |
+-------------------------------+-----------------------+
| server_audit_events           | CONNECT,QUERY,TABLE   |
| server_audit_excl_users       |                       |
| server_audit_file_path        | server_audit.log      |
| server_audit_file_rotate_now  | OFF                   |
| server_audit_file_rotate_size | 1000000               |
| server_audit_file_rotations   | 9                     |
| server_audit_incl_users       |                       |
| server_audit_logging          | ON                    |
| server_audit_mode             | 1                     |
| server_audit_output_type      | file                  |
| server_audit_syslog_facility  | LOG_USER              |
| server_audit_syslog_ident     | mysql-server_auditing |
| server_audit_syslog_info      |                       |
| server_audit_syslog_priority  | LOG_INFO              |
+-------------------------------+-----------------------+
14 rows in set (0.00 sec)

mysql> select version();
+-------------+
| version()   |
+-------------+
| 5.6.24-72.2 |
+-------------+
1 row in set (0.06 sec)

mysql> 

root@binlogic:/var/lib/mysql# ls
auto.cnf  debian-5.6.flag  ibdata1  ib_logfile0  ib_logfile1  mysql  mysql_upgrade_info  performance_schema  server_audit.log  test
root@binlogic:/var/lib/mysql# 

root@binlogic:/var/lib/mysql# tail -f server_audit.log 
20150601 14:44:29,binlogic,root,localhost,47,5,QUERY,,'set global server_audit_logging=ON',0
20150601 14:44:31,binlogic,root,localhost,47,6,QUERY,,'SHOW GLOBAL VARIABLES LIKE \'server_audit%\'',0
20150601 14:45:45,binlogic,root,localhost,47,7,QUERY,,'select version()',0
20150601 14:46:00,binlogic,root,localhost,47,0,DISCONNECT,,,0

About the Author