一、MYSQL审计方法分类
1.借助init-connect和binlog实现变相审计，不过不能对root用户（超级权限的用户）进行审计。
2.MYSQL 企业版增加MySQL Enterprise Audit Plugin
3.macfee公司基于percona开发的mysql audit插件：支持MYSQL、MariaDB、percona
4.MariaDB Audit Plugin(只支持MariaDB)
二、macfee的mysql audit插件安装
1.解压插件包
# unzip audit-plugin-mysql-5.5-1.0.9-585-linux-x86_64.zip
2.执行命令获取MySQL的plugin目录
mysql> SHOW GLOBAL VARIABLES LIKE 'plugin_dir';
+---------------+-------------------------------+
| Variable_name | Value |
+---------------+-------------------------------+
| plugin_dir | /www/server/mysql/lib/plugin/ |
+---------------+-------------------------------+
1 row in set (0.01 sec)
3.将解压好的插件复制到 MySQL 的插件目录下
# cp /root/audit-plugin-mysql-5.5-1.0.9-585/lib/libaudit_plugin.so /www/server/mysql/lib/plugin/
# chmod a+x /www/server/mysql/lib/plugin/libaudit_plugin.so
4.安装插件
mysql> install plugin audit soname 'libaudit_plugin.so';
如果出现以下报错，使用offset-extract.sh工具解决。
ERROR 1123 (HY000): Can't initialize function 'audit'; Plugin initialization function failed.
5.查看插件功能是否开启
mysql> show variables like '%audit_json_file%';
+-------------------------+-------+
| Variable_name | Value |
+-------------------------+-------+
| audit_json_file | OFF |
| audit_json_file_bufsize | 1 |
| audit_json_file_flush | OFF |
| audit_json_file_retry | 60 |
| audit_json_file_sync | 0 |
+-------------------------+-------+
6.查看mysql当前已经加载了哪些插件
mysql> show plugins;
+--------------------------+----------+--------------------+---------+---------+
| Name | Status | Type | Library | License |
+--------------------------+----------+--------------------+---------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
| mysql_native_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| mysql_old_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| CSV | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MEMORY | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MyISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MRG_MYISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
7.查看插件版本
mysql> show global status like '%audit%';
mysql> show global status like '%binlog%';
+----------------------------+--------+
| Variable_name | Value |
+----------------------------+--------+
| Binlog_cache_disk_use | 3 |
| Binlog_cache_use | 379 |
| Binlog_stmt_cache_disk_use | 2 |
| Binlog_stmt_cache_use | 850687 |
| Com_binlog | 0 |
| Com_show_binlog_events | 0 |
| Com_show_binlogs | 1 |
+----------------------------+--------+
7 rows in set (0.01 sec)
8.开启Audit功能
mysql> SET GLOBAL audit_json_file=ON;
Query OK, 0 rows affected (0.00 sec)
9.可以查看插件有哪些可配置的参数
mysql> SHOW GLOBAL VARIABLES LIKE '%audi%';
mysql> SHOW GLOBAL VARIABLES LIKE '%binlog%';
+-----------------------------------------+----------------------+
| Variable_name | Value |
+-----------------------------------------+----------------------+
| binlog_cache_size | 32768 |
| binlog_direct_non_transactional_updates | OFF |
| binlog_format | MIXED |
| binlog_stmt_cache_size | 32768 |
| innodb_locks_unsafe_for_binlog | OFF |
| max_binlog_cache_size | 18446744073709547520 |
| max_binlog_size | 1073741824 |
| max_binlog_stmt_cache_size | 18446744073709547520 |
| sync_binlog | 0 |
+-----------------------------------------+----------------------+
9 rows in set (0.01 sec)
10.Audit需要关注的参数有：
audit_json_file是否开启audit功能。
audit_json_log_file记录文件的路径和名称信息（默认放在mysql数据目录下）。
audit_record_cmds audit记录的命令，默认为记录所有命令。可以设置为任意dml、dcl、ddl的组合。如：audit_record_cmds=select,insert,delete,update。还可以在线设置set global audit_record_cmds=NULL。(表示记录所有命令)
audit_record_objsaudit记录操作的对象，默认为记录所有对象，可以用SET GLOBAL audit_record_objs=NULL设置为默认。也可以指定为下面的格式：audit_record_objs=,test.*,mysql.*,information_schema.*。
audit_whitelist_users用户白名单。
11.为了保证重启数据库，配置不丢失，修改my.cnf配置文件，将下面的配置添加到 [mysqld] 中，所以在配置文件中my.cnf加入参数：
audit_json_file=on #保证mysql重启后自动启动插件
plugin-load=AUDIT=libaudit_plugin.so #防止删除了插件，重启后又会加载
audit_record_cmds='insert,delete,update,create,drop,alter,grant,truncate' #要记录哪些命令语句,因为默认记录所有操作；
audit_offsets=7824, 7872, 3632, 4792, 456, 360, 0, 32, 64, 160, 536, 7988, 4360, 3648, 3656, 3660, 6072, 2072, 8, 7056, 7096, 7080, 13464, 148, 672
12.卸载插件的方法
mysql> uninstall plugin audit;
URL：
https://dl.bintray.com/mcafee/mysql-audit-plugin/
https://bintray.com/mcafee/mysql-audit-plugin/release
https://github.com/mcafee/mysql-audit/wiki
https://github.com/mcafee/mysql-audit/blob/master/offset-extract/offset-extract.sh
https://www.cnblogs.com/waynechou/p/mysql_audit.html
