Installing and Configuring the MariaDB Audit Plugin for MySQL

MySQL Community Edition does not include an audit plugin, so the article recommends using the GPL‑licensed MariaDB audit plugin as a cost‑free alternative.

Migration and installation : Download the MariaDB 10.1.46 Linux tarball (≈1.3 GB), extract it, locate server_audit.so under ./mariadb-10.1.46-linux-x86_64/lib/plugin/ , copy the file to MySQL's plugin directory (e.g., /usr/lib/mysql/plugin/ ), and load it with:

mysql> install plugin server_audit SONAME 'server_audit.so';

mysql> show plugins;

The plugin appears as SERVER_AUDIT with status ACTIVE.

Configuration : Refer to the official MariaDB audit plugin documentation for detailed options. Important variables can be inspected with:

mysql> show variables like '%audit%';

Key variables include server_audit_logging , server_audit_events , server_audit_file_path , server_audit_file_rotate_size , etc. Enable auditing and set desired events using:

SET GLOBAL server_audit_logging=ON;

SET GLOBAL server_audit_events='connect,query';

Persist these settings by adding them to the MySQL configuration file:

[server]

server_audit_logging=ON

server_audit_events=connect,query

Audit log files and format : Force a log rotation with:

mysql> set global server_audit_file_rotate_now=ON;

New audit files are created in the MySQL data directory (e.g., server_audit.log , server_audit.log.1 ). Important parameters controlling file size, rotation count, and output type are server_audit_file_rotate_size , server_audit_file_rotations , and server_audit_output_type . The log format is a CSV line:

[timestamp],[serverhost],[username],[host],[connectionid],[queryid],[operation],[database],[object],[retcode]

Example entry:

20200820 11:04:04,infokist,superuser,localhost,23,4759,QUERY,ds_db,'select count(*) from vm_zfs_storage',0

By following these steps, MySQL can capture connection and query events for security auditing without purchasing the commercial MySQL Enterprise Audit plugin.