MariaDB overview

    Last updated on:

    MariaDB is an open-source, relational database management system (RDBMS). It supports advanced clustering, high availability, and powerful storage engines for enterprise applications. MariaDB is widely used for web applications, cloud services, and large-scale data processing.

    MariaDB extension scope

    The MariaDB extension for Log360Cloud enables integration of MariaDB logs into the Log360 Cloud ecosystem. This extension provides features such as log collection, parsing, reporting, alerting, correlation, and advanced log search capabilities.

    Configuring MariaDB auditing

    MariaDB auditing can be configured using two methods:

    1. Configuring variables in a file
    2. Configuring variables in the CLI

    Configuring variables in a file

    1. Open the MariaDB configuration file:
      • For Windows:C:\Program Files\MariaDB 11.5\data\my.ini
      • For Linux:/etc/my.cnf or /etc/mysql/my.cnf
    2. Add the following lines to enable auditing: 
      plugin_load_add = server_audit
server_audit=FORCE_PLUS_PERMANENT
server_audit_logging = ON
server_audit_file_path = C:/Program Files/MariaDb 11.5/data/server_audit.log 
server_audit_events = CONNECT,QUERY,QUERY_DDL,QUERY_DML,QUERY_DCL

    Configuring Variables in the CLI

    1. Connect to MariaDB CLI

      Open MySQL Client or execute:

      mysql -u [username] -p [password]
    2. Install the audit plugin: 
      INSTALL SONAME 'server_audit';
    3. To see a list of audit plugin-related variables on the server and their values, execute the follow while connected to the server: 
      SHOW GLOBAL VARIABLES LIKE 'server_audit%';
    4. To have the audit plugin log more than one type of event, put them in a comma-separated list and execute the below command: 
      SET GLOBAL server_audit_events = 'CONNECT,QUERY,QUERY_DDL,QUERY_DML,QUERY_DCL';

    Audited events

    Here are the types of audited events captured from MariaDB in Log360 Cloud:

    Category Events
    DDL auditing Database created, Database dropped, Tables created, Tables dropped, Tables altered, Procedures created, Procedures dropped, Procedures altered, Index created, Index dropped, Triggers created, Triggers dropped, Views created, Views dropped, Views altered, Function created, Function dropped, Function altered
    DML auditing Select queries, Insert queries, Update queries, Delete queries, Truncate queries
    Execution analysis Failed queries
    Auditing account management Role created, Role dropped, Role updated, Grant operations, Revoke operations, Password changed, User created, User dropped, User updated, Failed account management queries
    Logon events User logon, Failed user logon, User logoff, Logon/logoff trends
    Server events Startup, Shutdown
    Administrative statements SET and SHOW statements, Transaction and Locking statements, Utility statements, Replication statements, Table maintenance statements, Plugin statements

    Configuring in Log360 Cloud

    After installing the MariaDB extension in Log360 Cloud, configure the scheduled import for the server_audit.log file from the MariaDB Server file path. Ensure that the correct file path is used during configuration.

    Navigate to Settings → Configuration Settings → Log Source Configuration → Import Logs → From Device

    Note: Refer to the Import Logs document for the step-by-step procedure.

    Viewing MariaDB reports

    To view MariaDB reports, navigate to the Reports tab and select MariaDB from the Custom Reports sub-tab.

    MariaDB overview

    Enable MariaDB correlation rules

    To view the correlation rules, navigate to the Correlation tab -> Manage Rules.

    In the Manage Rules page, select MariaDB as the Rule Category to filter out the related correlation rules. You can enable them manually by selecting the rule and clicking on Activate in the Rule Status column.

    MariaDB overview

    Enabling MariaDB Alerts

    To view the Alerts, navigate to the Alerts tab -> Manage Alert Profiles.

    1. In the Manage Alert Profiles page, select Custom Alert Profiles as the Alert Profile Type. Click the search icon and add MariaDB to filter out the alert profile(s). Select the profile(s) and click the green check mark icon icon-enable to enable the alert profile.
      MariaDB overview
    2. To associate the log source, click the edit icon to open the Edit Alert Profile window. In the Log Source field, click the add button and select the configured log source for MariaDB. Click Update to save the changes.
      MariaDB overview