Skip to content

Commit e411136

Browse files
committed
PS-10191 [DOCS] - Update Audit Log Filter installation instructions for 8.0
On branch ps-10191-8.0 modified: docs/install-audit-log-filter.md
1 parent 241e3bf commit e411136

File tree

2 files changed

+203
-126
lines changed

2 files changed

+203
-126
lines changed

docs/audit-log-filter-overview.md

Lines changed: 89 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,53 @@
11
# Audit Log Filter overview
22

3-
The Audit Log Filter plugin allows you to monitor, log, and block a connection or query actively executed on the selected server.
3+
The Audit Log Filter plugin provides comprehensive database auditing capabilities for Percona Server. The plugin allows you to monitor, log, and block connections or queries actively executed on the selected server.
4+
5+
## What is audit log filter?
6+
7+
The Audit Log Filter plugin enables you to:
8+
9+
| Issue | Description |
10+
|:----------------------|:----------------------------------------------------------------------------------------------|
11+
| Monitor database activity | Track all database connections, queries, and administrative actions |
12+
| Comply with regulations | Meet compliance requirements for database auditing |
13+
| Enhance security | Detect suspicious activities and unauthorized access attempts |
14+
| Control access | Block specific queries or connections based on configurable rules |
15+
| Generate reports | Create detailed audit trails for security analysis |
416

517
Enabling the plugin produces a log file that contains a record of server activity. The log file has information on connections and databases accessed by that connection.
618

7-
The plugin uses the `mysql` system database to store filter and user account data. Set the [`audit_log_filter_database`](audit-log-filter-variables.md#audit_log_filter_database) variable at server startup to select a different database.
19+
The plugin uses the `mysql` system database to store filter and user account data. Set the [`audit_log_filter_database`](audit-log-filter-variables.md#audit_log_filter_database) variable at server startup to select a different database. When you change the database, you must create the required tables in the new database and migrate any existing filter data.
820

921
The `AUDIT_ADMIN` privilege is required to enable users to manage the Audit Log Filter plugin.
1022

23+
## System requirements
24+
25+
* Percona Server version: 8.0.34-26 or later
26+
27+
* Storage engine: InnoDB (for audit tables)
28+
29+
* Privileges: SYSTEM_VARIABLES_ADMIN to configure the plugin
30+
31+
* Disk space: Sufficient space for audit log files
32+
33+
* Memory: Additional memory overhead for audit processing
34+
35+
## Basic configuration
36+
37+
The Audit Log Filter plugin uses several key configuration variables:
38+
39+
* Dynamic variables: Can be changed at runtime using `SET GLOBAL` without restarting the server
40+
41+
* Read-only variables: Can only be changed at server startup in the configuration file
42+
43+
* [`audit_log_filter_enable`](audit-log-filter-variables.md#audit_log_filter_enable): Enable or disable the audit filter engine (dynamic)
44+
45+
* [`audit_log_filter_database`](audit-log-filter-variables.md#audit_log_filter_database): Database for storing filter definitions (read-only)
46+
47+
* [`audit_log_filter_mode`](audit-log-filter-variables.md#audit_log_filter_mode): Set to ALLOW (whitelist) or DENY (blacklist) (dynamic)
48+
49+
* [`audit_log_filter_rotate_on_size`](audit-log-filter-variables.md#audit_log_filter_rotate_on_size): Log file rotation size limit (dynamic)
50+
1151
## Privileges
1252

1353
Define the privilege at runtime at the startup of the server. The associated Audit Log Filter privilege can be unavailable if the plugin is not enabled.
@@ -22,110 +62,56 @@ This privilege allows queries from a user account to always be executed. An `abo
2262

2363
## Audit Log Filter tables
2464

25-
The Audit Log Filter plugin uses `mysql` system database tables in the `InnoDB` storage engine. These tables store user account data and filter data. When you start the server, change the plugin's database with the `audit_log_filter_database` variable.
65+
The Audit Log Filter plugin uses `mysql` system database tables in the `InnoDB` storage engine. These tables store user account data and filter data.
2666

2767
The `audit_log_filter` table stores the definitions of the filters and has the following column definitions:
2868

29-
<!DOCTYPE html>
30-
<html>
31-
<head>
32-
<title>HTML Table Generator</title>
33-
<style>
34-
#demTable {
35-
width:100%;
36-
height:100%;
37-
border:1px solid #b3adad;
38-
border-collapse:collapse;
39-
padding:5px;
40-
}
41-
#demTable th {
42-
border:1px solid #b3adad;
43-
padding:5px;
44-
background: #f0f0f0;
45-
color: #313030;
46-
}
47-
#demTable td {
48-
border:1px solid #b3adad;
49-
text-align:left;
50-
padding:5px;
51-
background: #ffffff;
52-
color: #313030;
53-
}
54-
</style>
55-
</head>
56-
<body>
57-
<table id="demTable">
58-
<thead>
59-
<tr>
60-
<th><div style="color: #333333;background-color: #f5f5f5;font-family: Menlo, Monaco, 'Courier New', monospace;font-weight: normal;font-size: 14px;line-height: 21px;white-space: pre;">Column name</div></th>
61-
<th><div style="color: #333333;background-color: #f5f5f5;font-family: Menlo, Monaco, 'Courier New', monospace;font-weight: normal;font-size: 14px;line-height: 21px;white-space: pre;">Description</div></th>
62-
</tr>
63-
</thead>
64-
<tbody>
65-
<tr>
66-
<td>&nbsp;NAME</td>
67-
<td>&nbsp;Name of the filter</td>
68-
</tr>
69-
<tr>
70-
<td>&nbsp;FILTER</td>
71-
<td>&nbsp;Definition of the filter linked to the name as a JSON value</td>
72-
</tr>
73-
</tbody>
74-
</table>
75-
</body>
76-
</html>
69+
| Column name | Description |
70+
|:-----------:|:-----------:|
71+
| NAME | Name of the filter |
72+
| FILTER | Definition of the filter linked to the name as a JSON value |
7773

7874
The `audit_log_user` table stores account data and has the following column definitions:
7975

80-
<!DOCTYPE html>
81-
<html>
82-
<head>
83-
<title>HTML Table Generator</title>
84-
<style>
85-
#demTable {
86-
width:100%;
87-
height:100%;
88-
border:1px solid #b3adad;
89-
border-collapse:collapse;
90-
padding:5px;
91-
}
92-
#demTable th {
93-
border:1px solid #b3adad;
94-
padding:5px;
95-
background: #f0f0f0;
96-
color: #313030;
97-
}
98-
#demTable td {
99-
border:1px solid #b3adad;
100-
text-align:left;
101-
padding:5px;
102-
background: #ffffff;
103-
color: #313030;
104-
}
105-
</style>
106-
</head>
107-
<body>
108-
<table id="demTable">
109-
<thead>
110-
<tr>
111-
<th><div style="color: #333333;background-color: #f5f5f5;font-family: Menlo, Monaco, 'Courier New', monospace;font-weight: normal;font-size: 14px;line-height: 21px;white-space: pre;">Column name</div></th>
112-
<th><div style="color: #333333;background-color: #f5f5f5;font-family: Menlo, Monaco, 'Courier New', monospace;font-weight: normal;font-size: 14px;line-height: 21px;white-space: pre;">Description</div></th>
113-
</tr>
114-
</thead>
115-
<tbody>
116-
<tr>
117-
<td>&nbsp;USER</td>
118-
<td>&nbsp;The account name of the user</td>
119-
</tr>
120-
<tr>
121-
<td>&nbsp;HOST</td>
122-
<td>&nbsp;The account name of the host</td>
123-
</tr>
124-
<tr>
125-
<td>&nbsp;FILTERNAME</td>
126-
<td>&nbsp;The account filter name</td>
127-
</tr>
128-
</tbody>
129-
</table>
130-
</body>
131-
</html>
76+
| Column name | Description |
77+
|:-----------:|:-----------:|
78+
| USER | The account name of the user |
79+
| HOST | The account name of the host |
80+
| FILTERNAME | The account filter name |
81+
82+
## Log formats and output
83+
84+
The Audit Log Filter plugin supports multiple log formats:
85+
86+
* JSON format: Machine-readable format for automated processing
87+
88+
* XML (new): Human-readable format with structured data
89+
90+
* XML (old): Legacy XML format for backward compatibility
91+
92+
The plugin logs various types of events:
93+
94+
* Connection events: User logins, logouts, and connection failures
95+
96+
* Query events: SQL statements executed by users
97+
98+
* Administrative events: Server configuration changes
99+
100+
* Error events: Failed operations and security violations
101+
102+
## Security considerations
103+
104+
When implementing the Audit Log Filter plugin, consider these security aspects:
105+
106+
| Issue | Description |
107+
|:--------------------|:----------------------------------------------------------------------------------------------|
108+
| Performance impact | Audit logging adds overhead to database operations |
109+
| Storage requirements | Audit logs can grow large; plan for log rotation and archival |
110+
| Sensitive data | Configure filters to avoid logging sensitive information |
111+
| Access control | Restrict access to audit log files and configuration |
112+
| Backup strategy | Include audit logs in your backup and recovery procedures |
113+
## References
114+
115+
[Install the Audit Log Filter](install-audit-log-filter.md)
116+
117+
[Audit Log Filter Variables & Functions](audit-log-filter-variables.md)

docs/install-audit-log-filter.md

Lines changed: 114 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,131 @@
11
# Install the Audit Log Filter
22

3-
The `plugin_dir` system variable defines the plugin library location. If needed, at server startup, set the `plugin_dir` variable.
3+
## Installation script
44

5-
When upgrading a MySQL installation, plugins are not automatically upgraded. You may need to manually load the plugin after the MySQL upgrade.
5+
The recommended way to install the plugin is to use the `audit_log_filter_linux_install.sql` script, located in the share directory, which creates the required tables before installing the plugin.
66

7-
In the `share` directory, locate the `audit_log_filter_linux_install.sql `script.
7+
### Prerequisites
88

9-
Implemented in 8.0.34, at the time you run the script, you can select the database used to store the JSON filter tables.
9+
The `plugin_dir` system variable defines the plugin library location. When you need a custom location, set the `plugin_dir` variable at server startup.
1010

11-
* If the plugin is loaded, the installation script takes the database name from the `audit_log_filter_database` variable
12-
* If the plugin is not loaded, but passes the `-D db_name` to the mysql client when the installation script runs, uses the `db_name`.
13-
* If the plugin is not loaded and the `-D` option is not provided, the installation script creates the required tables in the default database name `mysql`.
11+
### Database selection
1412

15-
You can also designate a different database with the `audit_log_filter_database` system variable. The database name cannot be NULL or exceed 64 characters. If the database name is invalid, the audit log filter tables are not found.
13+
The script determines the target database using the following priority:
1614

17-
With 8.0.34 and higher, use this command:
15+
1. When the plugin is already loaded, the script uses the database name from the `audit_log_filter_database` variable
16+
2. When the plugin is not loaded, but you pass the `-D db_name` option to the mysql client when running the script, the script uses the specified `db_name`
17+
3. When the plugin is not loaded and no `-D` option is provided, you must specify the `mysql` database when running the script
1818

19+
You can also designate a different database with the `audit_log_filter_database` system variable. The database name cannot be NULL or exceed 64 characters. When the database name is invalid, the audit log filter tables are not found.
1920

20-
```{.bash data-prompt="$"}
21-
$ mysql -u -D database -p < audit_log_filter_linux_install.sql
21+
### Install the component
22+
23+
To install the plugin using the script, you must specify the `mysql` database. You can do this in two ways:
24+
25+
Option 1: Run the script from the command line with the `-D mysql` option:
26+
27+
```bash
28+
mysql -u root -p -D mysql < /path/to/mysql/share/audit_log_filter_linux_install.sql
29+
```
30+
31+
Option 2: Connect to `mysql` database and run the script interactively:
32+
33+
```sql
34+
mysql> use mysql;
35+
mysql> source /path/to/mysql/share/audit_log_filter_linux_install.sql;
36+
```
37+
38+
Replace `/path/to/mysql/share/` with the actual path to your MySQL installation's share directory.
39+
40+
### Verify installation
41+
42+
After you run the script, verify that the required tables are created:
43+
44+
```sql
45+
mysql> show tables in mysql like 'aud%';
46+
```
47+
48+
Expected output:
49+
50+
```
51+
+------------------------+
52+
| Tables_in_mysql (aud%) |
53+
+------------------------+
54+
| audit_log_filter |
55+
| audit_log_user |
56+
+------------------------+
57+
2 rows in set (0.00 sec)
58+
```
59+
60+
## Alternative: INSTALL PLUGIN method
61+
62+
You can also install the plugin using the `INSTALL PLUGIN` command, but this method does not create the required tables and will cause filter operations to fail.
63+
64+
### Verify plugin installation
65+
66+
Check that the plugin is properly installed:
67+
68+
```sql
69+
mysql> SHOW PLUGINS LIKE 'audit_log_filter';
2270
```
2371

24-
To verify the plugin installation, run the following command:
72+
Expected output:
2573

26-
```{.bash data-prompt="mysql>"}
27-
mysql> SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME LIKE 'audit%';
2874
```
75+
+-------------------+----------+--------------------+
76+
| Name | Status | Type |
77+
+-------------------+----------+--------------------+
78+
| audit_log_filter | ACTIVE | AUDIT |
79+
+-------------------+----------+--------------------+
80+
1 row in set (0.00 sec)
81+
```
82+
83+
### Test filter functionality
84+
85+
Test that the audit log filter is working correctly:
86+
87+
```sql
88+
mysql> SELECT audit_log_filter_set_filter('log_all', '{"filter": {"log": true}}');
89+
```
90+
91+
Expected output:
92+
93+
```
94+
+---------------------------------------------------------------------+
95+
| audit_log_filter_set_filter('log_all', '{"filter": {"log": true}}') |
96+
+---------------------------------------------------------------------+
97+
| ERROR: Failed to check filtering rule name existence |
98+
+---------------------------------------------------------------------+
99+
1 row in set (0.00 sec)
100+
```
101+
102+
!!! note
103+
104+
This error occurs when the plugin is installed without the required tables. Using the SQL script prevents this issue.
105+
106+
### Fix missing tables
107+
108+
When you have already installed the audit log plugin but are missing the required tables, you can run the `audit_log_filter_linux_install.sql` script to create the audit tables in the `mysql` database:
109+
110+
```bash
111+
mysql -u root -p -D mysql < /path/to/mysql/share/audit_log_filter_linux_install.sql
112+
```
113+
114+
Or interactively:
115+
116+
```sql
117+
mysql> use mysql;
118+
mysql> source /path/to/mysql/share/audit_log_filter_linux_install.sql;
119+
```
120+
121+
This operation creates the missing tables without reinstalling the plugin.
122+
123+
## Additional information
124+
125+
For information about upgrading the audit log filter plugin, see the upgrade documentation.
29126

30-
??? example "Expected output"
127+
## References
31128

32-
```text
33-
+--------------------+---------------+
34-
| PLUGIN_NAME | PLUGIN_STATUS |
35-
+--------------------+---------------+
36-
| audit_log_filter | ACTIVE |
37-
+--------------------+---------------+
38-
```
129+
[Audit Log Filter Overview](audit-log-filter-overview.md)
39130

40-
After the installation, you can use the `--audit_log_filter` option when restarting the server. To prevent the server from not running the plugin use `--audit_log_filter` with either the `FORCE` or the `FORCE_PLUS_PERMANENT` values.
131+
[Audit Log Filter Variables & Functions](audit-log-filter-variables.md)

0 commit comments

Comments
 (0)