Enable audit_plugin

[penrod]

I have a requirement to run audit logs to syslog. I can enable the audit_plugin by adding these lines to /etc/mysql/my.cnf and restarting the mysql monit jobs:

Audit Plugin options

plugin-load = server_audit=server_audit.so
server_audit_events = connect,query
server_audit_output_type = syslog
server_audit_logging = ON

I don't see a way to add these values into the deployment manifest. Can a trigger be set (if server_audit) to enable the plugin and look for the remaining values in the manifest?

cf_mysql.mysql.server_audit_events
cf_mysql.mysql.server_audit_output_type
cf_mysql.mysql.server_audit_logging

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/113966825.

[mfine30]

Hey @penrod,

Thanks for getting in touch. The mysql job already supports sending logs to a syslog drain. Is a standard syslog drain enough for your use case, or are you trying to do something more complicated? If it is, would using the already built in syslog feature of the mysql job satisfy your use case?

It's worth mentioning that the next version of CF MySQL Release, v26, will enable local logs regardless of whether you have configured a syslog drain. You can track that work in the following story https://www.pivotaltracker.com/story/show/111344064

Best,
Morgan && Ben
CF Core Services

[penrod]

Enabling the syslog drain sends the mysql error logs to our remote
aggregator ok. Good to know that v26 will allow us to have local logs as
well.

The problem is that I want to enable the audit_plugin to write to the
syslog, but I have to manually edit the my.cnf file on each server. I
checked the cf-mysql repo, but I don't see the values in the spec files or
the my.cnf.erb that would allow the audit properties to be defined in the
manifest so it goes out with the deploy. Is that an option that can be
added or is there another way to enable the audit logs?

On Wed, Feb 17, 2016 at 5:50 PM, Morgan Fine notifications@github.com
wrote:

Hey @penrod https://github.com/penrod,

Thanks for getting in touch. The mysql job already supports sending logs
to a syslog drain. Is a standard syslog drain enough for your use case, or
are you trying to do something more complicated? If it is, would using the
already built in syslog feature
https://github.com/cloudfoundry/cf-mysql-release/blob/develop/jobs/mysql/spec#L27-L36
of the mysql job satisfy your use case?

It's worth mentioning that the next version of CF MySQL Release, v26, will
enable local logs regardless of whether you have configured a syslog drain.
You can track that work in the following story
https://www.pivotaltracker.com/story/show/111344064

Best,
Morgan && Ben
CF Core Services

—
Reply to this email directly or view it on GitHub
#89 (comment)
.

[menicosia]

Hi @penrod,

This is a neat feature! I've put your request in the backlog such that it should be delivered in a coming cf-mysql-release. Thanks!

If you are interested to provide a PR, please look at the additions I've made in the story linked above - we'd like to automate some of the decision making if possible, so that the Operator needs to declare only the bare minimum in the manifest.

Marco Nicosia
Product Manager
Pivotal Software, Inc.

[youngm]

Has this been fixed?
9b953d5

[mfine30]

Hi @penrod, @youngm,

cf-mysql-release v27 was released and includes the audit logging feature that you have requested. I'm going to close this out now, but feel free to open another issue if this doesn't address your concerns.

Best,
Morgan