Skip to content

Commit 7398be9

Browse files
v-danschv-dansch
authored
Merge pull request #79229 from ajlam/audit-log-preview
Audit log preview
2 parents baed477 + 5d72ff2 commit 7398be9

15 files changed

+231
-31
lines changed

‎articles/mysql/TOC.yml

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -93,8 +93,10 @@
9393
items:
9494
- name: Monitor
9595
href: concepts-monitoring.md
96-
- name: Server logs
96+
- name: Slow query logs
9797
href: concepts-server-logs.md
98+
- name: Audit logs
99+
href: concepts-audit-logs.md
98100
- name: Development
99101
items:
100102
- name: Drivers and tools compatibility
@@ -165,10 +167,16 @@
165167
href: howto-auto-grow-storage-portal.md
166168
- name: Access server logs
167169
items:
168-
- name: Azure portal
169-
href: howto-configure-server-logs-in-portal.md
170-
- name: Azure CLI
171-
href: howto-configure-server-logs-in-cli.md
170+
- name: Slow query logs
171+
items:
172+
- name: Azure portal
173+
href: howto-configure-server-logs-in-portal.md
174+
- name: Azure CLI
175+
href: howto-configure-server-logs-in-cli.md
176+
- name: Audit logs
177+
items:
178+
- name: Azure portal
179+
href: howto-configure-audit-logs-portal.md
172180
- name: Monitor
173181
items:
174182
- name: Create alerts on metrics

‎articles/mysql/concepts-audit-logs.md

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
title: Audit logs for Azure Database for MySQL
3+
description: Describes the audit logs available in Azure Database for MySQL, and the available parameters for enabling logging levels.
4+
author: ajlam
5+
ms.author: andrela
6+
ms.service: mysql
7+
ms.topic: conceptual
8+
ms.date: 06/11/2019
9+
---
10+
11+
# Audit Logs in Azure Database for MySQL
12+
13+
In Azure Database for MySQL, the audit log is available to users. The audit log can be used to track database-level activity and is commonly used for compliance.
14+
15+
> [!IMPORTANT]
16+
> Audit log functionality is currently in preview.
17+
18+
## Configure audit logging
19+
20+
By default the audit log is disabled. To enable it, set `audit_log_enabled` to ON.
21+
22+
Other parameters you can adjust include:
23+
24+
- `audit_log_events`: controls the events to be logged. See below table for specific audit events.
25+
- `audit_log_exclude_users`: MySQL users to be excluded from logging. Allows for at most four users. Max length of the parameter is 256 characters.
26+
27+
| **Event** | **Description** |
28+
|---|---|
29+
| `CONNECTION` | - Connection initiation (successful or unsuccessful) <br> - User reauthentication with different user/password during session <br> - Connection termination |
30+
| `DML_SELECT`| SELECT queries |
31+
| `DML_NONSELECT` | INSERT/DELETE/UPDATE queries |
32+
| `DML` | DML = DML_SELECT + DML_NONSELECT |
33+
| `DDL` | Queries like "DROP DATABASE" |
34+
| `DCL` | Queries like "GRANT PERMISSION" |s
35+
| `ADMIN` | Queries like "SHOW STATUS" |
36+
| `GENERAL` | All in DML_SELECT, DML_NONSELECT, DML, DDL, DCL, and ADMIN |
37+
| `TABLE_ACCESS` | - Only available for MySQL 5.7 <br> - Table read statements, such as SELECT or INSERT INTO ... SELECT <br> - Table delete statements, such as DELETE or TRUNCATE TABLE <br> - Table insert statements, such as INSERT or REPLACE <br> - Table update statements, such as UPDATE |
38+
39+
## Access audit logs
40+
41+
Audit logs are integrated with Azure Monitor Diagnostic Logs. Once you've enabled audit logs on your MySQL server, you can emit them to Azure Monitor logs, Event Hubs, or Azure Storage. To learn more about how to enable diagnostic logs in the Azure portal, see the [audit log portal article](howto-configure-audit-logs-portal.md#set-up-diagnostic-logs).
42+
43+
## Schemas
44+
45+
The following sections describe what's output by MySQL audit logs based on the event type. Depending on the output method, the fields included and the order in which they appear may vary.
46+
47+
### Connection
48+
49+
| **Property** | **Description** |
50+
|---|---|
51+
| `TenantId` | Your tenant ID |
52+
| `SourceSystem` | `Azure` |
53+
| `TimeGenerated` [UTC] | Time stamp when the log was recorded in UTC |
54+
| `Type` | Type of the log. Always `AzureDiagnostics` |
55+
| `SubscriptionId` | GUID for the subscription that the server belongs to |
56+
| `ResourceGroup` | Name of the resource group the server belongs to |
57+
| `ResourceProvider` | Name of the resource provider. Always `MICROSOFT.DBFORMYSQL` |
58+
| `ResourceType` | `Servers` |
59+
| `ResourceId` | Resource URI |
60+
| `Resource` | Name of the server |
61+
| `Category` | `MySqlAuditLogs` |
62+
| `OperationName` | `LogEvent` |
63+
| `event_class` | `connection_log` |
64+
| `event_subclass` | `CONNECT`, `DISCONNECT`, `CHANGE USER` (only available for MySQL 5.7) |
65+
| `connection_id` | Unique connection ID generated by MySQL |
66+
| `host` | Blank |
67+
| `ip` | IP address of client connecting to MySQL |
68+
| `user` | Name of user executing the query |
69+
| `db` | Name of database connected to |
70+
| `\_ResourceId` | Resource URI |
71+
72+
### General
73+
74+
Schema below applies to GENERAL, DML_SELECT, DML_NONSELECT, DML, DDL, DCL, and ADMIN event types.
75+
76+
| **Property** | **Description** |
77+
|---|---|
78+
| `TenantId` | Your tenant ID |
79+
| `SourceSystem` | `Azure` |
80+
| `TimeGenerated` [UTC] | Time stamp when the log was recorded in UTC |
81+
| `Type` | Type of the log. Always `AzureDiagnostics` |
82+
| `SubscriptionId` | GUID for the subscription that the server belongs to |
83+
| `ResourceGroup` | Name of the resource group the server belongs to |
84+
| `ResourceProvider` | Name of the resource provider. Always `MICROSOFT.DBFORMYSQL` |
85+
| `ResourceType` | `Servers` |
86+
| `ResourceId` | Resource URI |
87+
| `Resource` | Name of the server |
88+
| `Category` | `MySqlAuditLogs` |
89+
| `OperationName` | `LogEvent` |
90+
| `event_class` | `general_log` |
91+
| `event_subclass` | `LOG`, `ERROR`, `RESULT` (only available for MySQL 5.6) |
92+
| `event_time` | Query start seconds in UNIX timestamp |
93+
| `error_code` | Error code if query failed. `0` means no error |
94+
| `thread_id` | ID of thread that executed the query |
95+
| `host` | Blank |
96+
| `ip` | IP address of client connecting to MySQL |
97+
| `user` | Name of user executing the query |
98+
| `sql_text` | Full query text |
99+
| `\_ResourceId` | Resource URI |
100+
101+
### Table access
102+
103+
| **Property** | **Description** |
104+
|---|---|
105+
| `TenantId` | Your tenant ID |
106+
| `SourceSystem` | `Azure` |
107+
| `TimeGenerated` [UTC] | Time stamp when the log was recorded in UTC |
108+
| `Type` | Type of the log. Always `AzureDiagnostics` |
109+
| `SubscriptionId` | GUID for the subscription that the server belongs to |
110+
| `ResourceGroup` | Name of the resource group the server belongs to |
111+
| `ResourceProvider` | Name of the resource provider. Always `MICROSOFT.DBFORMYSQL` |
112+
| `ResourceType` | `Servers` |
113+
| `ResourceId` | Resource URI |
114+
| `Resource` | Name of the server |
115+
| `Category` | `MySqlAuditLogs` |
116+
| `OperationName` | `LogEvent` |
117+
| `event_class` | `table_access_log` |
118+
| `event_subclass` | `READ`, `INSERT`, `UPDATE`, or `DELETE` |
119+
| `connection_id` | Unique connection ID generated by MySQL |
120+
| `db` | Name of database accessed |
121+
| `table` | Name of table accessed |
122+
| `sql_text` | Full query text |
123+
| `\_ResourceId` | Resource URI |
124+
125+
## Next steps
126+
127+
- [How to configure audit logs in the Azure portal](howto-configure-audit-logs-portal.md)

‎articles/mysql/concepts-monitoring.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ These metrics are available for Azure Database for MySQL:
3535
|backup_storage_used|Backup Storage Used|Bytes|The amount of backup storage used.|
3636

3737
## Server logs
38-
You can enable slow query logging on your server. These logs are also available through Azure Diagnostic Logs in Azure Monitor logs, Event Hubs, and Storage Account. To learn more about logging, visit the [server logs](concepts-server-logs.md) page.
38+
You can enable slow query and audit logging on your server. These logs are also available through Azure Diagnostic Logs in Azure Monitor logs, Event Hubs, and Storage Account. To learn more about logging, visit the [audit logs](concepts-audit-logs.md) and [slow query logs](concepts-server-logs.md) articles.
3939

4040
## Next steps
4141
- See [How to set up alerts](howto-alert-on-metric.md) for guidance on creating an alert on a metric.

‎articles/mysql/concepts-server-logs.md

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
---
22
title: Server logs for Azure Database for MySQL
3-
description: Describes the logs available in Azure Database for MySQL, and the available parameters for enabling different logging levels.
3+
description: Describes the slow query logs available in Azure Database for MySQL, and the available parameters for enabling different logging levels.
44
author: ajlam
55
ms.author: andrela
66
ms.service: mysql
77
ms.topic: conceptual
8-
ms.date: 02/28/2019
8+
ms.date: 05/29/2019
99
---
10-
# Server Logs in Azure Database for MySQL
11-
In Azure Database for MySQL, the slow query log is available to users. Access to the transaction log is not supported. The slow query log can be used to identify performance bottlenecks for troubleshooting.
10+
# Slow query logs in Azure Database for MySQL
11+
In Azure Database for MySQL, the slow query log is available to users. Access to the transaction log is not supported. The slow query log can be used to identify performance bottlenecks for troubleshooting.
1212

1313
For more information about the MySQL slow query log, see the MySQL reference manual's [slow query log section](https://dev.mysql.com/doc/refman/5.7/en/slow-query-log.html).
1414

15-
## Access server logs
16-
You can list and download Azure Database for MySQL server logs using the Azure portal, and the Azure CLI.
15+
## Access slow query logs
16+
You can list and download Azure Database for MySQL slow query logs using the Azure portal, and the Azure CLI.
1717

1818
In the Azure portal, select your Azure Database for MySQL server. Under the **Monitoring** heading, select the **Server Logs** page.
1919

@@ -24,8 +24,7 @@ Logs are available for up to seven days from their creation. If the total size o
2424

2525
Logs are rotated every 24 hours or 7 GB, whichever comes first.
2626

27-
28-
## Configure logging
27+
## Configure slow query logging
2928
By default the slow query log is disabled. To enable it, set slow_query_log to ON.
3029

3130
Other parameters you can adjust include:
@@ -67,10 +66,10 @@ The following table describes what's in each log. Depending on the output method
6766
| `rows_sent_s` | Number of rows sent |
6867
| `rows_examined_s` | Number of rows examined |
6968
| `last_insert_id_s` | [last_insert_id](https://dev.mysql.com/doc/refman/8.0/en/information-functions.html#function_last-insert-id) |
70-
| `insert_id_s` | Insert id |
69+
| `insert_id_s` | Insert ID |
7170
| `sql_text_s` | Full query |
72-
| `server_id_s` | The server's id |
73-
| `thread_id_s` | Thread id |
71+
| `server_id_s` | The server's ID |
72+
| `thread_id_s` | Thread ID |
7473
| `\_ResourceId` | Resource URI |
7574

7675
## Next Steps

‎articles/mysql/howto-configure-audit-logs-portal.md

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
title: Configure and access audit logs for Azure Database for MySQL in Azure portal
3+
description: This article describes how to configure and access the audit logs in Azure Database for MySQL from the Azure portal.
4+
author: ajlam
5+
ms.author: andrela
6+
ms.service: mysql
7+
ms.topic: conceptual
8+
ms.date: 06/11/2019
9+
---
10+
11+
# Configure and access audit logs in the Azure portal
12+
13+
You can configure the [Azure Database for MySQL audit logs](concepts-audit-logs.md) and diagnostic settings from the Azure portal.
14+
15+
> [!IMPORTANT]
16+
> Audit log functionality is currently in preview.
17+
18+
## Prerequisites
19+
20+
To step through this how-to guide, you need:
21+
22+
- [Azure Database for MySQL server](quickstart-create-mysql-server-database-using-azure-portal.md)
23+
24+
## Configure audit logging
25+
26+
Enable and configure audit logging.
27+
28+
1. Sign in to the [Azure portal](https://portal.azure.com/).
29+
30+
1. Select your Azure Database for MySQL server.
31+
32+
1. Under the **Settings** section in the sidebar, select **Server parameters**.
33+
![Server parameters](./media/howto-configure-audit-logs-portal/server-parameters.png)
34+
35+
1. Update the **audit_log_enabled** parameter to ON.
36+
![Enable audit logs](./media/howto-configure-audit-logs-portal/audit-log-enabled.png)
37+
38+
1. Select the events to be logged by updating the **audit_log_events** parameter.
39+
![Audit log events](./media/howto-configure-audit-logs-portal/audit-log-events.png)
40+
41+
1. Add any MySQL users to be excluded from logging by updating the **audit_log_exclude_users** parameter. Specify users by providing their MySQL user name.
42+
![Audit log exclude users](./media/howto-configure-audit-logs-portal/audit-log-exclude-users.png)
43+
44+
1. Once you have changed the parameters, you can click **Save**. Or you can **Discard** your changes.
45+
![Save](./media/howto-configure-audit-logs-portal/save-parameters.png)
46+
47+
## Set up diagnostic logs
48+
49+
1. Under the **Monitoring** section in the sidebar, select **Diagnostic settings**.
50+
51+
1. Click on "+ Add diagnostic setting"
52+
![Add diagnostic setting](./media/howto-configure-audit-logs-portal/add-diagnostic-setting.png)
53+
54+
1. Provide a diagnostic setting name.
55+
56+
1. Specify which data sinks to send the audit logs (storage account, event hub, and/or Log Analytics workspace).
57+
58+
1. Select "MySqlAuditLogs" as the log type.
59+
![Configure diagnostic setting](./media/howto-configure-audit-logs-portal/configure-diagnostic-setting.png)
60+
61+
1. Once you've configured the data sinks to pipe the audit logs to, you can click **Save**.
62+
![Save diagnostic setting](./media/howto-configure-audit-logs-portal/save-diagnostic-setting.png)
63+
64+
1. Access the audit logs by exploring them in the data sinks you configured. It may take up to 10 minutes for the logs to appear.
65+
66+
## Next steps
67+
68+
- Learn more about [audit logs](concepts-audit-logs.md) in Azure Database for MySQL.

‎articles/mysql/howto-configure-server-logs-in-cli.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.author: raagyema
66
ms.service: mysql
77
ms.devlang: azurecli
88
ms.topic: conceptual
9-
ms.date: 02/28/2018
9+
ms.date: 05/29/2019
1010
---
1111
# Configure and access server logs by using Azure CLI
1212
You can download the Azure Database for MySQL server logs by using Azure CLI, the Azure command-line utility.
@@ -32,7 +32,7 @@ az mysql server configuration list --resource-group myresourcegroup --server myd
3232
```
3333

3434
## List logs for Azure Database for MySQL server
35-
To list the available log files for your server, run the [az mysql server-logs list](/cli/azure/mysql/server-logs#az-mysql-server-logs-list) command.
35+
To list the available slow query log files for your server, run the [az mysql server-logs list](/cli/azure/mysql/server-logs#az-mysql-server-logs-list) command.
3636

3737
You can list the log files for server **mydemoserver.mysql.database.azure.com** under the resource group **myresourcegroup**. Then direct the list of log files to a text file called **log\_files\_list.txt**.
3838
```azurecli-interactive
@@ -47,4 +47,4 @@ az mysql server-logs download --name 20170414-mydemoserver-mysql.log --resource-
4747
```
4848

4949
## Next steps
50-
- Learn about [server logs in Azure Database for MySQL](concepts-server-logs.md).
50+
- Learn about [slow query logs in Azure Database for MySQL](concepts-server-logs.md).

‎articles/mysql/howto-configure-server-logs-in-portal.md

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
---
2-
title: Configure and access server logs for Azure Database for MySQL in Azure Portal
3-
description: This article describes how to configure and access the server logs in Azure Database for MySQL from the Azure Portal.
2+
title: Configure and access slow query logs for Azure Database for MySQL in Azure portal
3+
description: This article describes how to configure and access the slow logs in Azure Database for MySQL from the Azure portal.
44
author: rachel-msft
55
ms.author: raagyema
66
ms.service: mysql
77
ms.topic: conceptual
8-
ms.date: 02/28/2018
8+
ms.date: 05/29/2019
99
---
1010

11-
# Configure and access server logs in the Azure portal
11+
# Configure and access slow query logs in the Azure portal
1212

13-
You can configure, list, and download the [Azure Database for MySQL server logs](concepts-server-logs.md) from the Azure portal.
13+
You can configure, list, and download the [Azure Database for MySQL slow query logs](concepts-server-logs.md) from the Azure portal.
1414

1515
## Prerequisites
1616
To step through this how-to guide, you need:
@@ -37,7 +37,7 @@ Configure access to the MySQL slow query log.
3737
6. Return to the list of logs by clicking the **close button** (X icon) on the **Server Parameters** page.
3838

3939
## View list and download logs
40-
Once logging begins, you can view a list of available logs and download individual log files on the Server Logs pane.
40+
Once logging begins, you can view a list of available slow query logs and download individual log files on the Server Logs pane.
4141

4242
1. Open the Azure portal.
4343

@@ -56,9 +56,7 @@ Once logging begins, you can view a list of available logs and download individu
5656

5757
![Click download icon](./media/howto-configure-server-logs-in-portal/5-download.png)
5858

59-
6059
## Next steps
61-
- See [Access Server Logs in CLI](howto-configure-server-logs-in-cli.md) to learn how to download logs programmatically.
62-
- Learn more about [Server Logs](concepts-server-logs.md) in Azure Database for MySQL.
63-
- For more information about the parameter definitions and MySQL logging, see the MySQL documentation on [Logs](https://dev.mysql.com/doc/refman/5.7/en/slow-query-log.html).
64-
60+
- See [access slow query Logs in CLI](howto-configure-server-logs-in-cli.md) to learn how to download slow query logs programmatically.
61+
- Learn more about [slow query logs](concepts-server-logs.md) in Azure Database for MySQL.
62+
- For more information about the parameter definitions and MySQL logging, see the MySQL documentation on [Logs](https://dev.mysql.com/doc/refman/5.7/en/slow-query-log.html).

‎articles/mysql/media/howto-configure-audit-logs-portal/add-diagnostic-setting.png

73.5 KB
Loading

‎articles/mysql/media/howto-configure-audit-logs-portal/audit-log-enabled.png

144 KB
Loading

‎articles/mysql/media/howto-configure-audit-logs-portal/audit-log-events.png

148 KB
Loading

0 commit comments

Comments
 (0)