国产的路感觉越走越远，越走越迷糊
1，在mysql的share目录下找到初始化table/routing/plugin的sql文件，然后在mysql库下执行，文件名是audit_log_filter_linux_install.sql，内容如下
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# Copyright (c) 2016, 2025, Oracle and/or its affiliates. CREATE TABLE IF NOT EXISTS audit_log_filter(NAME VARCHAR(64) BINARY NOT NULL PRIMARY KEY, FILTER JSON NOT NULL) engine= InnoDB CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_ci; CREATE TABLE IF NOT EXISTS audit_log_user(USER VARCHAR(32) BINARY NOT NULL, HOST VARCHAR(255) CHARACTER SET ASCII NOT NULL, FILTERNAME VARCHAR(64) BINARY NOT NULL, PRIMARY KEY (USER, HOST), FOREIGN KEY (FILTERNAME) REFERENCES audit_log_filter(NAME)) engine= InnoDB CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_as_ci; INSTALL PLUGIN audit_log SONAME 'audit_log.so'; CREATE FUNCTION audit_log_filter_set_filter RETURNS STRING SONAME 'audit_log.so'; CREATE FUNCTION audit_log_filter_remove_filter RETURNS STRING SONAME 'audit_log.so'; CREATE FUNCTION audit_log_filter_set_user RETURNS STRING SONAME 'audit_log.so'; CREATE FUNCTION audit_log_filter_remove_user RETURNS STRING SONAME 'audit_log.so'; CREATE FUNCTION audit_log_filter_flush RETURNS STRING SONAME 'audit_log.so'; CREATE FUNCTION audit_log_read_bookmark RETURNS STRING SONAME 'audit_log.so'; CREATE FUNCTION audit_log_read RETURNS STRING SONAME 'audit_log.so'; CREATE FUNCTION audit_log_encryption_password_set RETURNS INTEGER SONAME 'audit_log.so'; CREATE FUNCTION audit_log_encryption_password_get RETURNS STRING SONAME 'audit_log.so'; CREATE FUNCTION audit_log_rotate RETURNS STRING SONAME 'audit_log.so'; SELECT audit_log_filter_flush() AS 'Result'; |
对应的这里还有一个卸载的脚本audit_log_filter_uninstall.sql，内容就不粘了
2，配置过滤规则
最简示例：配置一个过滤规则aud1，开启所有过滤，分配给所有用户
|
1 2 3 4 5 |
select audit_log_filter_set_filter('aud1','{"filter":{"log":true}}'); select audit_log_filter_set_user('%','aud1'); |
规则和用户信息都写在mysql.audit_log_filter和mysql.audit_log_user两个表中，可以直接查询
3，固化插件启动
在my.cnf中添加插件
#plugin
plugin-load=audit_log.so
4，修改日志类型
默认audit_log_format=NEW，也就是生成的audit.log是xml格式，如果要修改格式为json需要改配置文件并重启才能生效，不能动态改
audit-log-format=json