Mariadb 審計日誌部署
目前mysql企業版支持審計日誌功能，percona公司的插件可替代該插件(網絡了解mysql社區版可使用percona的審計插件，本人尚未實驗測試。)
本次實驗基於mariadb開啟審計日誌。
1.mariadb版本：mariadb10.1.19 在官方下載的二進制包中包含審計日誌插件。
2.查看數據庫是否安裝插件：
SHOW VARIABLES LIKE ‘%plugin_dir%‘;
看到此數據庫已安裝審計插件，卸載插件重新安裝。3.卸載插件
MariaDB [(none)]> UNINSTALL PLUGIN server_audit; ERROR 1702 (HY000): Plugin ‘server_audit‘ is force_plus_permanent and can not be unloaded
卸載插件報錯，需要修改參數。
server_audit=FORCE_PLUS_PERMANENT
參數防止刪除該插件參數。實驗中可重啟DB，實際生產中需謹慎操作。
vi /etc/my.cnf
#+#audit
#plugin_load=server_audit
#server_audit_events=connect,query_dml,query_ddl
#server_audit=FORCE_PLUS_PERMANENT
#server_audit_file_rotate_size = 128M
#server_audit_logging = ON
#sysdate_is_now = 1
重啟mysql：
卸載成功。
MariaDB [(none)]> unINSTALL PLUGIN server_audit;
ERROR 1305 (42000): PLUGIN server_audit does not exist
MariaDB [(none)]> show variables like ‘%audit%‘;
Empty set (0.00 sec)
4.安裝插件：
MariaDB [(none)]> INSTALL PLUGIN server_audit SONAME ‘libaudit_plugin.so‘;
安裝報錯：
原因未找到，還原my.cnf的配置文件註釋，並重啟mysql。
plugin_load=server_audit
server_audit_events=connect,query_dml,query_ddl
server_audit=FORCE_PLUS_PERMANENT
server_audit_file_rotate_size = 128M
server_audit_logging = ON
server_audit_file_path=/data01/mysql/log3306/server_audit.log
sysdate_is_now = 1
發現再次安裝：
MariaDB [(none)]> INSTALL PLUGIN server_audit SONAME ‘libaudit_plugin.so‘;
ERROR 1968 (HY000): Plugin ‘server_audit‘ already installed
MariaDB [(none)]> INSTALL PLUGIN server_audit SONAME ‘libaudit_plugin.so‘;
ERROR 1968 (HY000): Plugin ‘server_audit‘ already installed
Now，恐怖了。目前問題是，如果不註釋配置文件，那麽不能停止server_audit
+---------+------+----------------------------------------------------+
| Level | Code | Message |
+---------+------+----------------------------------------------------+
| Warning | 1620 | Plugin is busy and will be uninstalled on shutdown |
+---------+------+----------------------------------------------------+
註釋掉安裝找不到：Can‘t find symbol ‘server_audit‘ in library
5.錯誤解決：
原因：安裝的語法不正確。
註釋掉審計日誌的參數後，重啟mysql
安裝審計插件：MariaDB [(none)]> show variables like ‘%audit%‘;
Empty set (0.00 sec)
MariaDB [(none)]> INSTALL PLUGIN server_audit SONAME ‘server_audit.so‘;
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> show variables like ‘%audit%‘;
+-------------------------------+-----------------------+
| Variable_name | Value |
+-------------------------------+-----------------------+
| server_audit_events | |
| server_audit_excl_users | |
| server_audit_file_path | server_audit.log |
| server_audit_file_rotate_now | OFF |
| server_audit_file_rotate_size | 1000000 |
| server_audit_file_rotations | 9 |
| server_audit_incl_users | |
| server_audit_logging | OFF |
| server_audit_mode | 0 |
| server_audit_output_type | file |
| server_audit_query_log_limit | 1024 |
| server_audit_syslog_facility | LOG_USER |
| server_audit_syslog_ident | mysql-server_auditing |
| server_audit_syslog_info | |
| server_audit_syslog_priority | LOG_INFO |
+-------------------------------+-----------------------+
15 rows in set (0.01 sec)
此時審計日誌參數均為空，可以通過設置全局動態參數生效，此處為了重啟mysql後依然生效，筆者使用修改my.cnf參數進行配置審計日誌參數，即取消註銷參數。
plugin_load=server_audit
server_audit_events=connect,query_dml,query_ddl
server_audit=FORCE_PLUS_PERMANENT
server_audit_file_rotate_size = 128M
server_audit_logging = ON
server_audit_file_path=/data01/mysql/log3306/server_audit.log
sysdate_is_now = 1
重啟mysql；安裝完畢，大家千萬不要像筆者這樣粗心大意，文章較為混亂，望讀者謹慎參考。
註：INSTALL PLUGIN audit_log SONAME ‘audit_log.so‘; 為mysql安裝審計日誌語句。
Mariadb 審計日誌部署