Question

我的问题是即使我从审核日志记录中禁用了 root 用户，但仍然为这些用户登录。有人请帮忙。这是我一步一步做的。

[Setp -1]检查审核日志变量。

mysql> SHOW VARIABLES LIKE 'audit_log%';
+-----------------------------+--------------+
| Variable_name               | Value        |
+-----------------------------+--------------+
| audit_log_buffer_size       | 1048576      |
| audit_log_connection_policy | ALL          |
| audit_log_current_session   | ON           |
| audit_log_exclude_accounts  |              |
| audit_log_file              | audit.log    |
| audit_log_flush             | OFF          |
| audit_log_format            | OLD          |
| audit_log_include_accounts  |              |
| audit_log_policy            | ALL          |
| audit_log_rotate_on_size    | 0            |
| audit_log_statement_policy  | ALL          |
| audit_log_strategy          | ASYNCHRONOUS |
+-----------------------------+--------------+
12 rows in set (0.00 sec)

[SETP-2] 以下语句禁用 root 帐户的审核日志记录。

-- audit_log_include_accounts to NULL
SET GLOBAL audit_log_include_accounts = NULL;
SET GLOBAL audit_log_exclude_accounts = root@%;

注意：我使用 root @％而不是 root @ localhost ，因为此数据库服务器可以从另一个IP地址访问。

[Setp-3]我从远程PC调用select语句SELECT * FROM SSVR_AUDIT_LOG。

[步骤4]我检查了数据库服务器中的审核日志。

 <AUDIT_RECORD TIMESTAMP="2016-04-22T03:49:11 UTC" RECORD_ID="593_2016-04-22T01:28:17" NAME="Query" CONNECTION_ID="6" STATUS="0" STATUS_CODE="0" USER="root[root] @  [162.16.22.48]" OS_LOGIN="" HOST="" IP="162.16.22.48" COMMAND_CLASS="show_create_table" SQLTEXT="SHOW CREATE TABLE `SSVR_AUDIT_LOG`"/>
  <AUDIT_RECORD TIMESTAMP="2016-04-22T03:49:12 UTC" RECORD_ID="594_2016-04-22T01:28:17" NAME="Query" CONNECTION_ID="7" STATUS="0" STATUS_CODE="0" USER="root[root] @  [162.16.22.48]" OS_LOGIN="" HOST="" IP="162.16.22.48" COMMAND_CLASS="select" SQLTEXT="SELECT * FROM `SSVR_AUDIT_LOG` LIMIT 0, 1000"/>
  <AUDIT_RECORD TIMESTAMP="2016-04-22T03:49:12 UTC" RECORD_ID="595_2016-04-22T01:28:17" NAME="Query" CONNECTION_ID="7" STATUS="0" STATUS_CODE="0" USER="root[root] @  [162.16.22.48]" OS_LOGIN="" HOST="" IP="162.16.22.48" COMMAND_CLASS="show_fields" SQLTEXT="SHOW COLUMNS FROM `tldssvr`.`SSVR_AUDIT_LOG`"/>
  <AUDIT_RECORD TIMESTAMP="2016-04-22T03:49:13 UTC" RECORD_ID="596_2016-04-22T01:28:17" NAME="Quit" CONNECTION_ID="7" STATUS="0" STATUS_CODE="0" USER="root" OS_LOGIN="" HOST="" IP="162.16.22.48" COMMAND_CLASS="connect"/>

以下是我的参考链接enter link description here

Answer 1

我得到了我的问题的答案。这是正确的答案。当您面对该问题时，您可以按照以下步骤进行操作。

按帐户审核日志过滤

列出所有“审核日志”配置项

＆＃13;

>	mysql -u root -p
>	SHOW VARIABLES LIKE ‘audit_log%’;
+-----------------------------+--------------+
| Variable_name               | Value        |
+-----------------------------+--------------+
| audit_log_buffer_size       | 1048576      |
| audit_log_connection_policy | ALL          |
| audit_log_current_session   | OFF          |
| audit_log_exclude_accounts  |              |
| audit_log_file              | audit.log    |
| audit_log_flush             | OFF          |
| audit_log_format            | OLD          |
| audit_log_include_accounts  |              |
| audit_log_policy            | ALL          |
| audit_log_rotate_on_size    | 0            |
| audit_log_statement_policy  | ALL          |
| audit_log_strategy          | ASYNCHRONOUS |
+-----------------------------+--------------+

＆＃13;

在数据库服务器中添加远程应用程序服务器主机名和IP地址。

＆＃13;

> cat /etc/hosts
> 127.0.0.1   localhost localhost.localdomain localhost4  localhost4.localdomain4
  162.16.22.48 App_PC
 ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

＆＃13;

仅为应用程序数据库用户（root）本地主机和远程主机帐户禁用审核日志记录。

＆＃13;

> mysql –u root –p
>SET GLOBAL audit_log_include_accounts = NULL;
>SET GLOBAL audit_log_exclude_accounts = 'root@localhost,root@App_PC';

＆＃13;

列出所有“审核日志”配置项，并检查audit_log_exclude_account值。

＆＃13;

> SHOW VARIABLES LIKE 'audit_log%';
> +-----------------------------+----------------------------+
| Variable_name               | Value                      |
+-----------------------------+----------------------------+
| audit_log_buffer_size       | 1048576                    |
| audit_log_connection_policy | ALL                        |
| audit_log_current_session   | OFF                        |
| audit_log_exclude_accounts  | root@localhost,root@App_PC |
| audit_log_file              | audit.log                  |
| audit_log_flush             | OFF                        |
| audit_log_format            | OLD                        |
| audit_log_include_accounts  |                            |
| audit_log_policy            | ALL                        |
| audit_log_rotate_on_size    | 0                          |
| audit_log_statement_policy  | ALL                        |
| audit_log_strategy          | ASYNCHRONOUS               |
+-----------------------------+----------------------------+

＆＃13;

如何按用户帐户过滤mysql审核日志

1 个答案: