Configuring the MariaDB Audit Plugin to send MySQL events

The MariaDB Audit Plugin is supported for MySQL 5.7 versions up to 5.7.30 and is bundled with MariaDB.

To configure MySQL 5.7 event reporting using the MariaDB Audit Plugin:

1. Download the MariaDB distribution kit and extract it.

   You can download the MariaDB distribution kit from the official MariaDB website. The operating system of the MariaDB distribution must be the same as the operating system on which MySQL 5.7 is running.

2. Connect to MySQL 5.7 using an account with administrator rights by running the following command:

   mysql -u <username> -p

3. To get the directory where the MySQL 5.7 plugins are located, on the MySQL 5.7 command line, run the following command:

   SHOW GLOBAL VARIABLES LIKE 'plugin_dir'

4. In the directory obtained at step 3, copy the MariaDB Audit Plugin from <directory to which the distribution kit was extracted>/mariadb-server-<version>/lib/plugins/server_audit.so.
5. On the operating system command line, run the following command:

   chmod 755 <directory to which the distribution kit was extracted>server_audit.so

   For example:

   chmod 755 /usr/lib64/mysql/plugin/server_audit.so

6. On the MySQL 5.7 command line, run the following command:

   install plugin server_audit soname 'server_audit.so'

7. Create a backup copy of the /etc/mysql/mysql.conf.d/mysqld.cnf configuration file.
8. In the configuration file /etc/mysql/mysql.conf.d/mysqld.cnf, in the [mysqld] section, add the following lines:

   server_audit_logging=1

   server_audit_events=connect,table,query_ddl,query_dml,query_dcl

   server_audit_output_type=SYSLOG

   server_audit_syslog_facility=LOG_SYSLOG

   If you want to disable event export for certain audit event groups, remove some of the values from the server_audit_events setting. Descriptions of settings are available on the MariaDB Audit Plugin vendor's website.

9. Save changes to the configuration file.
10. Restart the MariaDB service by running one of the following commands:
    • systemctl restart mysqld for a system with systemd initialization.
    • service mysqld restart for a system with init initialization.

MariaDB Audit Plugin for MySQL 5.7 is configured. If necessary, you can run the following commands on the MySQL 5.7 command line:

• show plugins to check the list of current plugins.
• SHOW GLOBAL VARIABLES LIKE 'server_audit%' to check the current audit settings.