Configuring the MariaDB Audit Plugin to send MariaDB Events

The MariaDB Audit Plugin is included in the MariaDB distribution kit starting with versions 5.5.37 and 10.0.10.

To configure MariaDB event export using the MariaDB Audit Plugin:

1. Connect to MariaDB using an account with administrator rights by running the following command:

   mysql -u <username> -p

2. To check if the plugin is present in the directory where operating system plugins are located, run the following command on the MariaDB command line:

   SHOW GLOBAL VARIABLES LIKE 'plugin_dir'

3. On the operating system command line, run the following command:

   ll <directory obtained by the previous command> | grep server_audit.so

   If the command output is empty and the plugin is not present in the directory, you can either copy the MariaDB Audit Plugin to that directory or use a newer version of MariaDB.

4. On the MariaDB command line, run the following command:

   install plugin server_audit soname 'server_audit.so'

5. Create a backup copy of the /etc/mysql/my.cnf configuration file.
6. In the /etc/mysql/my.cnf configuration file, in the [mysqld] section, add the following lines:

   server_audit_logging=1

   server_audit_events=connect,table,query_ddl,query_dml,query_dcl

   server_audit_output_type=SYSLOG

   server_audit_syslog_facility=LOG_SYSLOG

   If you want to disable event export for certain audit event groups, remove some of the values from the server_audit_events setting. Descriptions of settings are available on the MariaDB Audit Plugin vendor's website.

7. Save changes to the configuration file.
8. Restart the MariaDB service by running one of the following commands:
   • systemctl restart mariadb for a system with systemd initialization.
   • service mariadb restart for a system with init initialization.

MariaDB Audit Plugin for MariaDB is configured. If necessary, you can run the following commands on the MariaDB command line:

• show plugins to check the list of current plugins.
• SHOW GLOBAL VARIABLES LIKE 'server_audit%' to check the current audit settings.