MySQL5.6 audit审计插件如何安装

2024-04-02 19:04:59 861人浏览独家记忆

摘要

小编给大家分享一下Mysql5.6 audit审计插件如何安装，相信大部分人都还不怎么了解，因此分享这篇文章给大家参考一下，希望大家阅读完这篇文章后大有收获，下面让我们一起去了解一下吧！

小编给大家分享一下Mysql5.6 audit审计插件如何安装，相信大部分人都还不怎么了解，因此分享这篇文章给大家参考一下，希望大家阅读完这篇文章后大有收获，下面让我们一起去了解一下吧！

audit审计插件的二进制包下载地址:
到https://bintray.com/mcafee/mysql-audit-plugin/release网站下载5.6对应的二进制包
名字为audit-plugin-mysql-5.6-1.1.2-694-linux-x86_64.zip

查看MySQL插件目录:
mysql> show global variables like 'plugin_dir';
+---------------+------------------------------+
| Variable_name | Value |
+---------------+------------------------------+
| plugin_dir | /usr/local/mysql/lib/plugin/ |
+---------------+------------------------------+
1 row in set (0.00 sec)

mysql> quit
Bye

解压缩并cp libaudit_plugin.so到MySQL对应的插件目录:
# cd /root
# unzip audit-plugin-mysql-5.6-1.1.2-694-linux-x86_64.zip
ArcHive: audit-plugin-mysql-5.6-1.1.2-694-linux-x86_64.zip
creating: audit-plugin-mysql-5.6-1.1.2-694/
creating: audit-plugin-mysql-5.6-1.1.2-694/lib/
inflating: audit-plugin-mysql-5.6-1.1.2-694/lib/libaudit_plugin.so
inflating: audit-plugin-mysql-5.6-1.1.2-694/COPYING
inflating: audit-plugin-mysql-5.6-1.1.2-694/THIRDPARTY.txt
inflating: audit-plugin-mysql-5.6-1.1.2-694/README.txt
creating: audit-plugin-mysql-5.6-1.1.2-694/utils/
inflating: audit-plugin-mysql-5.6-1.1.2-694/utils/offset-extract.sh

# cd /root/audit-plugin-mysql-5.6-1.1.2-694/lib

# cp libaudit_plugin.so /usr/local/mysql/lib/plugin/
#cd /usr/local/mysql/lib/plugin/
# chmod +x libaudit_plugin.so

编辑/etc/my.cnf,添加如下内容:
plugin-load=AUDIT=libaudit_plugin.so

# service mysqld restart
Shutting down MySQL..... [ OK ]
Starting MySQL..... [ OK ]

或者用命令安装plugin:
mysql>INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';

查看安装的plugin:
mysql> show plugins;
+----------------------------+----------+--------------------+--------------------+---------+
| Name | Status | Type | Library | License |
+----------------------------+----------+--------------------+--------------------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
| mysql_native_passWord | ACTIVE | AUTHENTICATioN | NULL | GPL |
| mysql_old_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| sha256_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| MyISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MRG_MYISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MEMORY | ACTIVE | STORAGE ENGINE | NULL | GPL |
| CSV | ACTIVE | STORAGE ENGINE | NULL | GPL |
| BLACKHOLE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| InnoDB | ACTIVE | STORAGE ENGINE | NULL | GPL |
| INNODB_TRX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCKS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCK_WaiTS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE_LRU | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_POOL_STATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_METRICS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DEFAULT_STOPWORD | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_BEING_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_CONFIG | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_CACHE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_TABLE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESTATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_INDEXES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_COLUMNS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FIELDS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN_COLS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESPACES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_DATAFILES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| PERFORMANCE_SCHEMA | ACTIVE | STORAGE ENGINE | NULL | GPL |
| FEDERATED | DISABLED | STORAGE ENGINE | NULL | GPL |
| ARCHIVE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| partition | ACTIVE | STORAGE ENGINE | NULL | GPL |
| AUDIT | ACTIVE | AUDIT | libaudit_plugin.so | GPL |
+----------------------------+----------+--------------------+--------------------+---------+
43 rows in set (0.00 sec)

可以看到最后一行有AUDIT libaudit_plugin.so的字样，说明安装成功.

mysql> SHOW GLOBAL VARIABLES LIKE 'audit%';
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Variable_name | Value |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| audit_before_after | after |
| audit_checksum | |
| audit_client_capabilities | OFF |
| audit_delay_cmds | |
| audit_delay_ms | 0 |
| audit_force_record_logins | OFF |
| audit_header_msg | ON |
| audit_JSON_file | OFF |
| audit_json_file_bufsize | 1 |
| audit_json_file_flush | OFF |
| audit_json_file_retry | 60 |
| audit_json_file_sync | 0 |
| audit_json_log_file | mysql-audit.json |
| audit_json_Socket | OFF |
| audit_json_socket_name | /var/run/db-audit/mysql.audit__usr_local_mysql_data_3306 |
| audit_json_socket_retry | 10 |
| audit_offsets | |
| audit_offsets_by_version | ON |
| audit_password_masking_cmds | CREATE_USER,GRANT,SET_OPTION,SLAVE_START,CREATE_SERVER,ALTER_SERVER,CHANGE_MASTER,UPDATE |
| audit_password_masking_regex | identified(?:/\*.*?\*/|\s)*?by(?:/\*.*?\*/|\s)*?(?:password)?(?:/\*.*?\*/|\s)*?['|"](?.*?)(?<!--\\)['|"]|password(?:/\*.*?\*/|\s)*?\((?:/\*.*?\*/|\s)*?['|"](?.*?)(?<!--\\)['|"](?:/\*.*?\*/|\s)*?\)|password(?:/\*.*?\*/|\s)*?(?:for(?:/\*.*?\*/|\s)*?\S+?)?(?:/\*.*?\*/|\s)*?=(?:/\*.*?\*/|\s)*?['|"](?.*?)(?<!--\\)['|"]|password(?:/\*.*?\*/|\s)*?['|"](?.*?)(?<!--\\)['|"] |<br /--&gt | audit_record_cmds | |
| audit_record_objs | |
| audit_sess_connect_attrs | ON |
| audit_socket_creds | ON |
| audit_uninstall_plugin | OFF |
| audit_validate_checksum | ON |
| audit_validate_offsets_extended | ON |
| audit_whitelist_cmds | BEGIN,COMMIT,PING |
| audit_whitelist_users | |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
29 rows in set (0.00 sec)

audit记录的命令,默认为记录所有命令

可以设置为任意dml、dcl、ddl的组合

如：audit_record_cmds=select,insert,delete,update

audit_record_objs

audit记录操作的对象,默认为记录所有对象,

可以用SET GLOBAL audit_record_objs=NULL设置为默认

也可以指定为下面的格式

audit_record_objs=,test.*,mysql.*,information_schema.*

测试如下:
查看是否开启audit功能:
mysql> show variables like 'audit_json_file';
+-----------------+-------+
| Variable_name | Value |
+-----------------+-------+
| audit_json_file | OFF |
+-----------------+-------+
1 row in set (0.00 sec)

开启audit功能:
mysql> set global audit_json_file=on;
Query OK, 0 rows affected (0.00 sec)

mysql> show variables like 'audit_json_file';
+-----------------+-------+
| Variable_name | Value |
+-----------------+-------+
| audit_json_file | ON |
+-----------------+-------+
1 row in set (0.00 sec)

审计test库的所有对象:
mysql> SET GLOBAL audit_record_objs='test.*';
Query OK, 0 rows affected (0.00 sec)

审计test库的insert,update和delete操作：
mysql> set global audit_record_cmds='insert,delete,update';
Query OK, 0 rows affected (0.00 sec)

查看记录文件的路径和名称信息:
mysql> show variables like 'audit_json_log_file';
+---------------------+------------------+
| Variable_name | Value |
+---------------------+------------------+
| audit_json_log_file | mysql-audit.json |
+---------------------+------------------+
1 row in set (0.00 sec)

文件路径如下:
mysql> system find / -name mysql-audit.json
/usr/local/mysql/data/mysql-audit.json

对test库下的person表做insert,update和delete测试:

mysql> insert into person values('5','liuyb','29');
Query OK, 1 row affected (0.03 sec)

mysql> update person set age='55' where name='dsf';
Query OK, 2 rows affected (0.04 sec)
Rows matched: 2 Changed: 2 Warnings: 0

mysql> delete from person where name='cf';
Query OK, 1 row affected (0.03 sec)

mysql> select * from person;
+----+----------+------+
| id | name | age |
+----+----------+------+
| 2 | dsf | 55 |
| 3 | dsf | 55 |
| 4 | chenfeng | 38 |
| 5 | liuyb | 29 |
+----+----------+------+
4 rows in set (0.00 sec)

打开/usr/local/mysql/data/mysql-audit.json文件查看审计数据:
[root@localhost lib]# cat /usr/local/mysql/data/mysql-audit.json
{"msg-type":"header","date":"1494389691599","audit-version":"1.1.2-694","audit-protocol-version":"1.0","hostname":"localhost","mysql-version":"5.6.27-log","mysql-program":"/usr/local/mysql/bin/mysqld","mysql-socket":"/tmp/mysql.sock","mysql-port":"3306","server_pid":"41506"}
{"msg-type":"activity","date":"1494389798201","thread-id":"6","query-id":"53","user":"root","priv_user":"root","ip":"","host":"localhost","connect_attrs":{"_os":"Linux","_client_name":"libmysql","_pid":"41662","_client_version":"5.6.27","_platform":"x86_64","program_name":"mysql"},"rows":"1","cmd":"insert","objects":[{"db":"test","name":"person","obj_type":"TABLE"}],"query":"insert into person values('5','liuyb','29')"}
{"msg-type":"activity","date":"1494389835611","thread-id":"6","query-id":"55","user":"root","priv_user":"root","ip":"","host":"localhost","connect_attrs":{"_os":"Linux","_client_name":"libmysql","_pid":"41662","_client_version":"5.6.27","_platform":"x86_64","program_name":"mysql"},"rows":"2","cmd":"update","objects":[{"db":"test","name":"person","obj_type":"TABLE"}],"query":"update person set age='55' where name='dsf'"}
{"msg-type":"activity","date":"1494390005360","thread-id":"6","query-id":"60","user":"root","priv_user":"root","ip":"","host":"localhost","connect_attrs":{"_os":"Linux","_client_name":"libmysql","_pid":"41662","_client_version":"5.6.27","_platform":"x86_64","program_name":"mysql"},"rows":"1","cmd":"delete","objects":[{"db":"test","name":"person","obj_type":"TABLE"}],"query":"delete from person where name='cf'"}

可以看到审计结果里有对test库person表的操作记录(insert,update和delete),至此，audit插件安装成功.

以上是“MySQL5.6 audit审计插件如何安装”这篇文章的所有内容，感谢各位的阅读！相信大家都有了一定的了解，希望分享的内容对大家有所帮助，如果还想学习更多知识，欢迎关注编程网数据库频道！

您可能感兴趣的文档:

点击免费下载>>软考高级考试备考技巧/历年真题/备考精华资料

--结束END--

本文标题: MySQL5.6 audit审计插件如何安装

本文链接: https://www.lsjlt.com/news/62563.html(转载时请注明来源链接)

有问题或投稿请发送至: 邮箱/279061341@qq.com QQ/279061341

本篇文章演示代码以及资料文档资料下载

下载Word文档到电脑，方便收藏和打印～

下载Word文档

去做题

猜你喜欢

sql怎么查看表的索引

通过查询系统表，可以获取表的索引信息，包括索引名称、是否唯一、索引类型、索引列和行数。常用系统表有：mysql 的 information_schema.statistics、postg...

99+

2024-05-14

mysql oracle
sql怎么查看索引

您可以使用 sql 通过以下方法查看索引：show indexes 语句：显示表中定义的索引列表及其信息。explain 语句：显示查询计划，其中包含用于执行查询的索引。informat...

99+

2024-05-14
sql怎么查看存储过程

如何查看 sql 存储过程的源代码：使用 show create procedure 语句直接获取创建脚本。查询 information_schema.routines 表的 routi...

99+

2024-05-14
sql怎么查看视图表

要查看视图表，可以使用以下步骤：使用 select 语句获取视图中的数据。使用 desc 语句查看视图的架构。使用 explain 语句分析视图的执行计划。使用 dbms 提供...

99+

2024-05-14

oracle python
sql怎么查看创建的视图

可以通过sql查询查看已创建的视图，具体步骤包括：连接到数据库并执行查询select * from information_schema.views;查询结果将显示视图的名称、...

99+

2024-05-14

mysql
sql怎么用循环语句实现查询

可以通过 do 和 while 语句创建循环，并在循环内执行查询，详细步骤包括：定义循环变量设置循环初始值循环执行查询更新循环变量执行查询循环退出条件 SQL 中使用循环语句实现查询 ...

99+

2024-05-14
sql怎么用代码修改表中数据

通过 sql 代码修改表中数据的方法包括：修改单个记录：使用 update 语句设置列值并指定条件。修改多条记录：在 update 语句中指定多个条件来修改满足条件的所有记录。增加新列：...

99+

2024-05-14
sql怎么用命令创建数据库

在 sql 中使用 create database 命令创建新数据库，其语法包含以下步骤：指定数据库名称。指定数据库文件和日志文件的位置（可选）。指定数据库大小、最大大小和文件增长（可选...

99+

2024-05-14
sql怎么用身份证提取年龄

sql 中提取身份证号码中的年龄的方法：提取出生日期部分（身份证号码中第 7-14 位）；使用 to_date 函数转换为日期格式；使用 extract 函数计算与当前日期之间的年差。 ...

99+

2024-05-14
sql怎么看字段长度

有两种方法可查看 sql 中的字段长度：使用 information_schema 架构，其中包含元数据信息，可用于查询字段长度。使用内建函数，如 length()，其适用于字符串数据类...

99+

2024-05-14