Comprehensive MySQL log auditing and security with EventLog Analyzer

MySQL, a popular open-source relational database management system, is widely used to manage and store data for web applications. It plays a crucial role in ensuring efficient and reliable data handling for various websites and services.

ManageEngine EventLog Analyzer, a powerful log management solution, audits MySQL logs to help maintain the database's performance, health, and security.

This tutorial outlines various use cases for monitoring and securing MySQL databases using EventLog Analyzer. To effectively monitor and secure MySQL databases through log monitoring, ensure your MySQL logs are configured to be sent to the EventLog Analyzer server.

MySQL log performance and health auditing using EventLog Analyzer: Use cases

EventLog Analyzer addresses various MySQL performance and health auditing scenarios through its effective log monitoring and comprehensive set of predefined reports. These reports provide valuable insights into database performance, security events, and user activities. They can be scheduled for automatic generation and distributed via email for responses to potential issues.

Use Case Description Why implement? Available Reports
Monitor and audit resource group management Track and audit the activities related to the creation, deletion, and modification of resource groups within the MySQL database. This use case is crucial for ensuring that resource groups are being managed according to policy and that unauthorized changes are not being made, which could impact database performance and security. Resource Group Management Statements
Monitor server events Track server startup and shutdown events. Identify unplanned restarts, ensure high availability, and troubleshoot server-related issues. Server Startup and Shutdown events
Audit configuration changes Track changes to system variables and database configuration settings. Ensure proper configuration, track unauthorized changes, and maintain optimal performance and security. Set Statements, Show Statements
Audit user access and authentication Monitor and analyze user login activities, including successful and failed login attempts. To enhance security by identifying unauthorized access attempts, brute-force attacks, and tracking user access patterns. Successful Logins, Failed Logins
Analyze replication performance Monitor replication processes and performance. Ensure data consistency across replicas, identify replication lag or failures, and maintain high availability. Replication Statements

MySQL log auditing using EventLog Analyzer: Use cases

MySQL log auditing captures detailed information about user activities within the database, offering valuable insights into user interactions and changes. These reports enable you to monitor access patterns, track modifications, and ensure compliance with security policies. By understanding MySQL log auditing reports, you can identify potential security risks, unauthorized access attempts, and maintain the integrity and performance of your database environment.

Use Case Description Why implement? Available reports
User access monitoring Monitor all user access attempts, both successful and failed. Identify unauthorized access attempts, ensure only authorized users access the database, and enhance security. Successful Logins, Failed Logins
DDL auditing Tracking and logging all changes to the database schema, such as creating, altering, or dropping tables, indexes, and other objects. Helps in identifying and understanding schema changes, ensures database structure integrity, and prevents unintended structural modifications. DDL Statements, Table Maintenance Statements
DML auditing Monitoring and logging operations that manipulate data within the database, including data insertion, updates, and deletions. Provides a record of data modifications, helps in identifying unauthorized data changes, and supports data recovery efforts. DML Statements, Transactional and Locking Statements
Auditing account and management operations Audit account and administrative activities, including user and system management. Ensure proper account management, prevent unauthorized access, comply with security policies, and maintain database health. Account Management Statements, Other Administrative Statements
Configuration change monitoring Track configuration changes, maintenance activities, and server events. Identify and audit configuration changes to prevent misconfigurations, ensure maintenance tasks are properly logged, optimize database performance, and monitor server uptime and stability. Set Statements, Show Statements, Server Startup and Shutdown events, Table Maintenance Statements
Server startup and shutdown surveillance Log server startup and shutdown activities. Unexpected server restarts or shutdowns can indicate hardware issues, power failures, or malicious activity. Monitoring these events helps in identifying and responding to potential threats or operational issues.

Alert profile: Server Startup and Shutdown Events

EventLog Analyzer comes with predefined alerts for server startup and shutdown events. Use a smart threshold or provide manual thresholds to detect unexpected or anomalous server shutdowns.

Securing MySQL database using EventLog Analyzer: Use cases

EventLog Analyzer offers various detection rules to identify and mitigate potential threats targeting MySQL database, including unauthorized access, data manipulation, and configuration changes. The below table illustrates some of the security use cases covered by EventLog Analyzer.

Use Case Description Why implement? Detection rules
Brute-force attack detection Detect excessive and anomalous logon failures. Detect and mitigate brute-force attacks to prevent unauthorized access to the database.

Alert profile:

  • Failed Logins
  • EventLog Analyzer comes with the above predefined alert profile for detecting failed logins.
  • Provide customized thresholds, such as the number of login failures, to detect excessive or abnormal logons in your MySQL environment.
  • Alternatively, you can enable the Smart Threshold capability to analyze and baseline logon failures in your MySQL environment and thereby get notified for excessive or anomalous login failure events.
Detect unauthorized database changes Monitor DDL (data definition language) operations to identify unauthorized changes to the database structure. Ensure compliance and prevent unauthorized structural changes to the database.

Alert profile:

  • DDL Statements
  • EventLog Analyzer provides predefined alerts for DDL operations. Customize this alert template to detect unauthorized changes from unusual locations or volume to detect anomalies.

MySQL compliance auditing with EventLog Analyzer

Most regulations mandate that organizations implement monitoring solutions for databases to track access and modifications, ensuring data security and integrity. The table below illustrates how EventLog Analyzer can help you meet compliance requirements for MySQL databases. For a detailed solution mapping, refer to this space.

Compliance requirements: Solution mapping
EventLog Analyzer reports and alerts Detection rules Regulations Requirements

MySQL logon reports

  • MySQL Logon Success
  • MySQL Logon Failures
 Failed Logins CMMC
  • C003 - AC.2.013
  • C013 - CM.2.061
POPIA Chapter 3 - Section 19 (2) (a)
ISLP
  • ARTICLE 12
  • ARTICLE 13
  • ARTICLE 19.3
  • ARTICLE 20.5
  • ARTICLE 30.4
  • ARTICLE 30.6
NRC
  • ACT B.1.6
  • ACT B.1.22
  • ACT B.2.6
  • ACT C.3.4
  • ACT C.3.7
  • ACT C.4.3
FERPA Section 99.31 (a)(1)(ii)
PDPA
  • RULE VI Section 25
  • RULE VII Section 30
SAMA
  • 3.2.1.1 Cyber Security Risk Identification
  • 3.2.1.3 Cyber Security Risk Response
  • 3.2.5 Cyber Security Audits
  • 3.3.5 Identity and Access Management
  • 3.3.6 Application Security
  • 3.3.7 Change Management
CJDN Application Development, Logging
QCF
  • 4.2 Application Security Service
  • 4.6.2 Threat Modelling
  • 6.2 Data Protection Service
  • 6.8.3 Data at rest
  • 7.2 Change and Patch Management Service
TISAX 8.11 Security monitoring and operations strategy
ECC 13.2 Identity and Access Management Service
PDPL
  • 4.1.2
  • 5.2.4
UAE-NASA 2-2 Identity and Access Management
LGPD
  • Article 19 - Information Security
  • Article 21 - Controls and Procedures for Dealing with Credit Data
  • T3.2.3
  • T5.2.2
  • Art 14

MySQL general statements

  • MySQL DDL Statements
  • MySQL DML Statements
  • MySQL Transaction and Locking Statements
  • MySQL Utility Statements
  • MySQL Replication Statements
 DML Statements, Replication Statements CMMC C013 - CM.2.061
POPIA
  • Chapter 3 - Section 19 (2) (a)
  • Chapter 3 - Section 20 (1) (b)
ISLP
  • ARTICLE 12
  • ARTICLE 13
  • ARTICLE 19.3
  • ARTICLE 20.5
  • ARTICLE 30.4
  • ARTICLE 30.6
NRC
  • ACT B.1.6
  • ACT B.1.22
  • ACT B.2.6
  • ACT C.3.4
  • ACT C.3.7
  • ACT C.4.3
FERPA Section 99.31 (a)(1)(ii)
PDPA
  • RULE VI Section 25
  • RULE VII Section 30
SAMA
  • 3.2.1.1 Cyber Security Risk Identification
  • 3.2.1.3 Cyber Security Risk Response
  • 3.3.6 Application Security
  • 3.3.7 Change Management
CJDN Application Development
QCF
  • 4.2 Application Security Service
  • 4.6.2 Threat Modelling
  • 6.2 Data Protection Service
  • 6.8.3 Data at rest
  • 7.2 Change and Patch Management Service
PDPL 8.11 Security monitoring and operations strategy
UAE-NASA
  • Article 19 - Information Security
  • Article 21 - Controls and Procedures for Dealing with Credit Data
LGPD
  • T3.2.3
  • Art 14

MySQL database administrative statements

  • MySQL Account Management Statements
  • MySQL Resource Group Management Statements
  • MySQL Table Maintenance Statements
  • MySQL Component And Plugin Statements
  • MySQL Other Administrative Statements
  • MySQL Set Statements
  • MySQL Show Statements
 Account Management Statements, Component and Plugin Statements, Resource Group Management Statements, Other Administrative Statements, Set Statements CMMC C013 - CM.2.061
ISLP
  • ARTICLE 12
  • ARTICLE 13
  • ARTICLE 19.3
  • ARTICLE 20.5
  • ARTICLE 30.4
  • ARTICLE 30.6
NRC
  • ACT B.1.6
  • ACT B.1.22
  • ACT B.2.6
  • ACT C.3.4
  • ACT C.3.7
  • ACT C.4.3
PDPA
  • RULE VI Section 25
  • RULE VII Section 30
SAMA
  • 3.2.1.3 Cyber Security Risk Response
  • 3.3.6 Application Security
CJDN Application Development
QCF
  • 4.2 Application Security Service
  • 4.6.2 Threat Modelling
  • 6.2 Data Protection Service
PDPL
  • Article 19 - Information Security
  • Article 21 - Controls and Procedures for Dealing with Credit Data

MySQL server events

  • Server Startup and Shutdown Events
 Server Startup and Shutdown Events CJDN Application Development
 

Additional Resource

MySQL database auditing with EventLog Analyzer