Skip to content

Commit 5d2f4e3

Browse files
Sync docs from Discourse (#503)
Co-authored-by: GitHub Actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 0a9c34e commit 5d2f4e3

File tree

6 files changed

+235
-80
lines changed

6 files changed

+235
-80
lines changed

docs/explanation/e-audit-logs.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Audit Logs
2+
3+
The Audit Log plugin allows all login/logout records to be stored in a log file. It is enabled in Charmed MySQL K8s by default.
4+
5+
## Overview
6+
7+
The following is a sample of the audit logs, with format json with login/logout records:
8+
9+
```json
10+
{"audit_record":{"name":"Quit","record":"6_2024-09-03T01:53:14","timestamp":"2024-09-03T01:53:33Z","connection_id":"992","status":0,"user":"clusteradmin","priv_user":"clusteradmin","os_login":"","proxy_user":"","host":"localhost","ip":"","db":""}}
11+
{"audit_record":{"name":"Connect","record":"7_2024-09-03T01:53:14","timestamp":"2024-09-03T01:53:33Z","connection_id":"993","status":1156,"user":"","priv_user":"","os_login":"","proxy_user":"","host":"juju-da2225-8","ip":"10.207.85.214","db":""}}
12+
{"audit_record":{"name":"Connect","record":"8_2024-09-03T01:53:14","timestamp":"2024-09-03T01:53:33Z","connection_id":"994","status":0,"user":"serverconfig","priv_user":"serverconfig","os_login":"","proxy_user":"","host":"juju-da2225-8","ip":"10.207.85.214","db":""}}
13+
```
14+
15+
The logs are stored in the `/var/log/mysql` directory of the mysql container, and it's rotated
16+
every minute to the `/var/log/mysql/archive_audit` directory.
17+
It's recommended to integrate the charm with [COS](/t/9900), from where the logs can be easily persisted and queried using Loki/Grafana.
18+
19+
## Configurations
20+
21+
1. `plugin-audit-enabled` - The audit plugin is enabled by default in the charm, but it's possible to disable it by setting:
22+
23+
```bash
24+
juju config mysql-k8s plugin-audit-enabled=false
25+
```
26+
Valid value are `false` and `true`. By setting it to false, existing logs are still kept in the `archive_audit` directory.
27+
28+
1. `plugin-audit-strategy` - By default the audit plugin writes logs in asynchronous mode for better performance.
29+
To ensure logs are written to disk on more timely fashion, this configuration can be set to semi-synchronous mode:
30+
31+
```bash
32+
juju config mysql-k8s plugin-audit-strategy=semi-async
33+
```
34+
Valid values are `async` and `semi-async`.

0 commit comments

Comments
 (0)