|
| 1 | +# Audit Logs |
| 2 | + |
| 3 | +The Audit Log plugin allows all login/logout records to be stored in a log file. It is enabled in Charmed MySQL K8s by default. |
| 4 | + |
| 5 | +## Overview |
| 6 | + |
| 7 | +The following is a sample of the audit logs, with format json with login/logout records: |
| 8 | + |
| 9 | +```json |
| 10 | +{"audit_record":{"name":"Quit","record":"6_2024-09-03T01:53:14","timestamp":"2024-09-03T01:53:33Z","connection_id":"992","status":0,"user":"clusteradmin","priv_user":"clusteradmin","os_login":"","proxy_user":"","host":"localhost","ip":"","db":""}} |
| 11 | +{"audit_record":{"name":"Connect","record":"7_2024-09-03T01:53:14","timestamp":"2024-09-03T01:53:33Z","connection_id":"993","status":1156,"user":"","priv_user":"","os_login":"","proxy_user":"","host":"juju-da2225-8","ip":"10.207.85.214","db":""}} |
| 12 | +{"audit_record":{"name":"Connect","record":"8_2024-09-03T01:53:14","timestamp":"2024-09-03T01:53:33Z","connection_id":"994","status":0,"user":"serverconfig","priv_user":"serverconfig","os_login":"","proxy_user":"","host":"juju-da2225-8","ip":"10.207.85.214","db":""}} |
| 13 | +``` |
| 14 | + |
| 15 | +The logs are stored in the `/var/log/mysql` directory of the mysql container, and it's rotated |
| 16 | +every minute to the `/var/log/mysql/archive_audit` directory. |
| 17 | +It's recommended to integrate the charm with [COS](/t/9900), from where the logs can be easily persisted and queried using Loki/Grafana. |
| 18 | + |
| 19 | +## Configurations |
| 20 | + |
| 21 | +1. `plugin-audit-enabled` - The audit plugin is enabled by default in the charm, but it's possible to disable it by setting: |
| 22 | + |
| 23 | + ```bash |
| 24 | + juju config mysql-k8s plugin-audit-enabled=false |
| 25 | + ``` |
| 26 | + Valid value are `false` and `true`. By setting it to false, existing logs are still kept in the `archive_audit` directory. |
| 27 | + |
| 28 | +1. `plugin-audit-strategy` - By default the audit plugin writes logs in asynchronous mode for better performance. |
| 29 | + To ensure logs are written to disk on more timely fashion, this configuration can be set to semi-synchronous mode: |
| 30 | + |
| 31 | + ```bash |
| 32 | + juju config mysql-k8s plugin-audit-strategy=semi-async |
| 33 | + ``` |
| 34 | + Valid values are `async` and `semi-async`. |
0 commit comments