2

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current estimate is that all traffic would have to go through a proxy that logs everything and transparently forwards it to the target database server. I have tried looking through the logging mechanisms inside MySQL and it doesn't seem to generate the information I need.

Is my assessment correct?

I don't know if this question belongs here (or if I should post a second question) but I have been reading into something called HashiCorp Vault as I've been told that it covers my use case. I don't see how a centralized secret storage system will help me with the generation of logs for auditing.

Does anyone know if this supposed Vault will actually log access or even act as a proxy?

  • I have no idea what you've actually asked that somebody suggested HashiCorp Vault - but no, it does not log access and use of to the database. "I have tried looking through the logging mechanisms inside MySQL and it doesn't seem to generate the information I need." - it is unclear what you need apart from what MySQL provides, see Log all queries in mysql. – Steffen Ullrich Jul 6 '19 at 20:39
1

If you are trying to track access to data from your MySQL database for HIPAA and the PCI Data Security Standard then you want MySQL Enterprise Audit plugin and there is also a MariaDB Audit plugin.

| improve this answer | |
1

MySQL does have logging mechanisms, although they are not enabled by default. It has an error log, an access log, a general query log, and a slow query log.

First you want to navigate to /etc/mysql/conf.d/mysqld_safe_syslog.cnf using your text editor of choice and comment out the lines related to logging. Then navigate to your MySQL config file (/etc/mysql/my.cnf) and add the following lines:

[mysqld_safe]
log_error=/var/log/mysql/mysql_error.log
[mysqld] 
log_error=/var/log/mysql/mysql_error.log
general_log_file = /var/log/mysql/mysql.log 
general_log = 1     
log_slow_queries = /var/log/mysql/mysql-slow.log
long_query_time = 2
log-queries-not-using-indexes

After this, you should restart your MySQLd Service: sudo service mysql restart

Then you want to ensure that logging is enabled at runtime... to do this, first login to your MySQL client (mysql -u root -p) then set the following global values:

SET GLOBAL general_log = 'ON'; 
SET GLOBAL slow_query_log = 'ON';

I'm not sure if I fully understood your question, but if it's errors and access attempts, along with queries that you are wanting to log, then this should suffice. Let me know if it's something else that you're wanting to log. I think this should be fine to do without any need for a proxy server.

Alternatively, there are plugins available to do this. Also I should note that despite logging being disabled by default on MySQL, errors will still be logged via syslog.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.