Skip to content

Commit 93b6b9a

Browse files
OP3ratordecOP3ratordec
authored
Merge pull request #590 from bytebase/o-branch-20
docs: add how to enable auditing references
2 parents f33e6ff + 86aeba7 commit 93b6b9a

File tree

4 files changed

+336
-0
lines changed

4 files changed

+336
-0
lines changed

‎content/reference/mysql/how-to/_layout.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313

1414
## [How to enable slow query log](/reference/mysql/how-to/how-to-enable-slow-query-log-mysql)
1515

16+
## [How to enable auditing](/reference/mysql/how-to/how-to-enable-auditing-mysql)
17+
1618
## [How to CREATE INDEX](/reference/mysql/how-to/how-to-create-index-mysql)
1719

1820
## [How to CREATE VIEW](/reference/mysql/how-to/how-to-create-view-mysql)
@@ -23,6 +25,8 @@
2325

2426
## [How to ALTER TABLE](/reference/mysql/how-to/how-to-alter-table-mysql)
2527

28+
## [How to ALTER large table](/reference/mysql/how-to/how-to-alter-large-table-mysql)
29+
2630
## [How to ALTER COLUMN TYPE](/reference/mysql/how-to/how-to-alter-column-type-mysql)
2731

2832
## [How to ADD CONSTRAINT](/reference/mysql/how-to/how-to-add-constraint-mysql)

‎content/reference/mysql/how-to/how-to-enable-auditing-mysql.md‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
---
2+
title: How to enable auditing in MySQL
3+
---
4+
5+
<HintBlock type="info">
6+
7+
MySQL auditing allows you to track and log database activity, including user connections, query execution, and data modifications. Audit logs are crucial for security compliance, troubleshooting, and monitoring user activity in your database environment.
8+
9+
Bytebase provides [centralized audit logging](/docs/security/audit-logging/) and [access control](/docs/security/data-access-control/) features that complement MySQL's native auditing capabilities for enterprise environments.
10+
11+
</HintBlock>
12+
13+
## MySQL Enterprise Audit Plugin (Enterprise Edition)
14+
15+
If you are using MySQL Enterprise Edition, you can enable the built-in audit plugin:
16+
17+
### Install the Audit Plugin
18+
19+
```sql
20+
-- Check if the plugin is already installed
21+
SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS
22+
WHERE PLUGIN_NAME LIKE 'audit%';
23+
24+
-- Install the plugin if not already installed
25+
INSTALL PLUGIN audit_log SONAME 'audit_log.so';
26+
```
27+
28+
### Configure Audit Settings
29+
30+
Add the following to your MySQL configuration file (e.g., `/etc/mysql/my.cnf`):
31+
32+
```plain
33+
[mysqld]
34+
audit_log=FORCE_PLUS_PERMANENT
35+
audit_log_format=JSON
36+
audit_log_file=/var/log/mysql/audit.log
37+
audit_log_policy=ALL
38+
```
39+
40+
- `audit_log`: Enables the audit log plugin
41+
- `audit_log_format`: Log format (JSON, NEW, or OLD)
42+
- `audit_log_file`: Path to the audit log file
43+
- `audit_log_policy`: Logging policy (ALL, LOGINS, QUERIES, NONE)
44+
45+
## MariaDB Audit Plugin (Community Edition)
46+
47+
For MySQL Community Edition, you can use the MariaDB Audit Plugin:
48+
49+
### Install the MariaDB Audit Plugin
50+
51+
Download the appropriate plugin for your MySQL version from [GitHub](https://github.com/mariadb-corporation/server-audit-plugin) and install it:
52+
53+
```sql
54+
-- Install the plugin
55+
INSTALL PLUGIN server_audit SONAME 'server_audit.so';
56+
```
57+
58+
### Configure MariaDB Audit Plugin
59+
60+
Add the following to your MySQL configuration file:
61+
62+
```plain
63+
[mysqld]
64+
server_audit_logging=ON
65+
server_audit_events=CONNECT,QUERY,TABLE
66+
server_audit_output_type=file
67+
server_audit_file_path=/var/log/mysql/audit.log
68+
```
69+
70+
- `server_audit_logging`: Enable or disable audit logging
71+
- `server_audit_events`: Types of events to log (CONNECT, QUERY, TABLE, etc.)
72+
- `server_audit_output_type`: Output type (file or syslog)
73+
- `server_audit_file_path`: Path to the audit log file
74+
75+
## Alternative: Using General Query Log
76+
77+
If you don't have access to audit plugins, you can use the general query log as a basic auditing solution:
78+
79+
```plain
80+
[mysqld]
81+
general_log=ON
82+
general_log_file=/var/log/mysql/general.log
83+
```
84+
85+
<HintBlock type="info">
86+
87+
Using general query logs for auditing produces large log files and can impact performance.
88+
89+
Bytebase offers [SQL review](/docs/sql-review/overview/) and [data access control](/docs/security/data-access-control/) features that provide audit capabilities with less overhead.
90+
91+
</HintBlock>
92+
93+
## Restart MySQL
94+
95+
After changing the MySQL configuration, restart MySQL to apply the changes:
96+
97+
```bash
98+
sudo systemctl restart mysql
99+
```
100+
101+
## Verify Auditing is Enabled
102+
103+
### For Enterprise Audit Plugin
104+
105+
```sql
106+
-- Check if the plugin is active
107+
SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS
108+
WHERE PLUGIN_NAME = 'audit_log';
109+
110+
-- View audit log variables
111+
SHOW VARIABLES LIKE 'audit_log%';
112+
```
113+
114+
### For MariaDB Audit Plugin
115+
116+
```sql
117+
-- Check if the plugin is active
118+
SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS
119+
WHERE PLUGIN_NAME = 'server_audit';
120+
121+
-- View audit variables
122+
SHOW VARIABLES LIKE 'server_audit%';
123+
```
124+
125+
### For General Log
126+
127+
```sql
128+
-- Check general log status
129+
SHOW VARIABLES LIKE 'general_log%';
130+
```
131+
132+
<HintBlock type="info">
133+
134+
For enterprise environments managing multiple MySQL instances, Bytebase provides [centralized schema change workflows](/docs/change-database/change-workflow/) with comprehensive [audit trails](/docs/security/audit-logging/) and [compliance checks](/docs/sql-review/review-policy/). This approach allows you to enforce consistent auditing policies across your database fleet.
135+
136+
</HintBlock>
137+
138+
## References
139+
140+
- [MySQL Enterprise Audit](https://dev.mysql.com/doc/refman/8.0/en/audit-log.html)
141+
- [MariaDB Audit Plugin](https://mariadb.com/kb/en/mariadb-audit-plugin/)
142+
- [MySQL General Query Log](https://dev.mysql.com/doc/refman/8.0/en/query-log.html)

‎content/reference/postgres/how-to/_layout.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919

2020
## [How to enable pg_stat_statements](/reference/postgres/how-to/how-to-enable-pg-stat-statements-postgres)
2121

22+
## [How to enable auditing](/reference/mysql/how-to/how-to-enable-auditing-mysql)
23+
2224
## [How to CREATE INDEX](/reference/postgres/how-to/how-to-create-index-postgres)
2325

2426
## [How to CREATE VIEW](/reference/postgres/how-to/how-to-create-view-postgres)

‎content/reference/postgres/how-to/how-to-enable-auditing-postgres.md‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
---
2+
title: How to enable auditing in PostgreSQL
3+
---
4+
5+
<HintBlock type="info">
6+
7+
PostgreSQL auditing allows you to track and log database activity, including user connections, query execution, and data modifications. Audit logs are crucial for security compliance, troubleshooting, and monitoring user activity in your database environment.
8+
9+
Bytebase provides [centralized audit logging](/docs/security/audit-logging/) and [access control](/docs/security/data-access-control/) features that complement PostgreSQL's native auditing capabilities for enterprise environments.
10+
11+
</HintBlock>
12+
13+
## PostgreSQL's Built-in Logging
14+
15+
PostgreSQL offers built-in logging capabilities that can be configured for basic auditing:
16+
17+
### Configure Log Settings
18+
19+
Add the following to your PostgreSQL configuration file (`postgresql.conf`):
20+
21+
```plain
22+
# Basic logging settings
23+
log_destination = 'csvlog'
24+
logging_collector = on
25+
log_directory = 'log'
26+
log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
27+
log_rotation_age = 1d
28+
log_rotation_size = 10MB
29+
30+
# What to log
31+
log_statement = 'all' # Options: none, ddl, mod, all
32+
log_connections = on
33+
log_disconnections = on
34+
log_duration = on
35+
```
36+
37+
- `log_statement`: Controls which SQL statements to log (none, ddl, mod, all)
38+
- `log_connections`: Log successful connections
39+
- `log_disconnections`: Log session terminations
40+
- `log_duration`: Include query execution time
41+
42+
## pg_audit Extension (Recommended)
43+
44+
For comprehensive auditing capabilities, install the `pgaudit` extension:
45+
46+
### Install pgaudit
47+
48+
For most distributions:
49+
50+
```bash
51+
# Debian/Ubuntu
52+
sudo apt-get install postgresql-[version]-pgaudit
53+
54+
# RHEL/CentOS
55+
sudo yum install pgaudit_[version]
56+
```
57+
58+
For source installation:
59+
60+
```bash
61+
git clone https://github.com/pgaudit/pgaudit.git
62+
cd pgaudit
63+
make install
64+
```
65+
66+
### Configure pgaudit
67+
68+
Add the following to your PostgreSQL configuration file (`postgresql.conf`):
69+
70+
```plain
71+
# Load the extension
72+
shared_preload_libraries = 'pgaudit'
73+
74+
# Audit settings
75+
pgaudit.log = 'write, ddl'
76+
pgaudit.log_catalog = on
77+
pgaudit.log_parameter = on
78+
pgaudit.log_statement_once = on
79+
pgaudit.log_level = 'log'
80+
```
81+
82+
Then enable the extension in your database:
83+
84+
```sql
85+
-- Connect to your database and run:
86+
CREATE EXTENSION pgaudit;
87+
```
88+
89+
### Audit Session Logging
90+
91+
For session-level auditing, which audits operations by specific users:
92+
93+
```sql
94+
-- Enable session audit logging for a user
95+
ALTER USER audited_user SET pgaudit.log = 'read, write';
96+
```
97+
98+
### Object-level Audit Logging
99+
100+
For more granular auditing of specific objects:
101+
102+
```sql
103+
-- Create audit role
104+
CREATE ROLE auditor;
105+
106+
-- Grant audit privileges on table
107+
GRANT SELECT ON sensitive_table TO auditor;
108+
109+
-- Enable object-level auditing for the table
110+
ALTER TABLE sensitive_table ENABLE AUDIT;
111+
```
112+
113+
<HintBlock type="info">
114+
115+
For large databases, selective auditing using `pgaudit.log_relation` can help minimize performance impact by focusing only on important tables.
116+
117+
Bytebase offers [SQL review](/docs/sql-review/overview/) and [data access control](/docs/security/data-access-control/) features that provide audit capabilities with less overhead.
118+
119+
</HintBlock>
120+
121+
## Alternative: WAL-based Auditing
122+
123+
For advanced use cases, you can use write-ahead log (WAL) decoding for auditing:
124+
125+
```plain
126+
# Enable logical decoding
127+
wal_level = logical
128+
max_replication_slots = 10
129+
```
130+
131+
This approach is more advanced but allows real-time monitoring of all data changes.
132+
133+
## Restart PostgreSQL
134+
135+
After changing the PostgreSQL configuration, restart the service to apply the changes:
136+
137+
```bash
138+
# For systemd-based systems
139+
sudo systemctl restart postgresql
140+
141+
# For older systems
142+
sudo service postgresql restart
143+
```
144+
145+
## Verify Auditing is Enabled
146+
147+
### For Built-in Logging
148+
149+
```sql
150+
-- Check current logging settings
151+
SHOW log_statement;
152+
SHOW log_connections;
153+
SHOW logging_collector;
154+
155+
-- View recent logs (if using csvlog format)
156+
SELECT * FROM pg_logical_slot_peek_changes('audit_slot', NULL, NULL);
157+
```
158+
159+
### For pgaudit Extension
160+
161+
```sql
162+
-- Verify the extension is installed
163+
SELECT * FROM pg_extension WHERE extname = 'pgaudit';
164+
165+
-- Check current pgaudit settings
166+
SHOW pgaudit.log;
167+
SHOW pgaudit.log_catalog;
168+
169+
-- Test with an auditable operation
170+
CREATE TABLE test_audit(id int);
171+
INSERT INTO test_audit VALUES (1);
172+
DROP TABLE test_audit;
173+
```
174+
175+
After these operations, check your log files for audit entries.
176+
177+
<HintBlock type="info">
178+
179+
For enterprise environments managing multiple PostgreSQL instances, Bytebase provides [centralized schema change workflows](/docs/change-database/change-workflow/) with comprehensive [audit trails](/docs/security/audit-logging/) and [compliance checks](/docs/sql-review/review-policy/). This approach allows you to enforce consistent auditing policies across your database fleet.
180+
181+
</HintBlock>
182+
183+
## References
184+
185+
- [PostgreSQL Logging Documentation](https://www.postgresql.org/docs/current/runtime-config-logging.html)
186+
- [pgAudit Extension](https://github.com/pgaudit/pgaudit)
187+
- [PostgreSQL WAL-based Auditing](https://www.postgresql.org/docs/current/logical-replication.html)
188+
- [Timescale Guide: What is Audit Logging in PostgreSQL](https://www.timescale.com/learn/what-is-audit-logging-and-how-to-enable-it-in-postgresql)

0 commit comments

Comments
 (0)