MariaDB overview

MariaDB is an open-source, relational database management system (RDBMS). It supports advanced clustering, high availability, and powerful storage engines for enterprise applications. MariaDB is widely used for web applications, cloud services, and large-scale data processing.

MariaDB extension scope

The MariaDB extension for Log360Cloud enables integration of MariaDB logs into the Log360 Cloud ecosystem. This extension provides features such as log collection, parsing, reporting, alerting, correlation, and advanced log search capabilities.

Configuring MariaDB auditing

MariaDB auditing can be configured using two methods:

1. Configuring variables in a file
2. Configuring variables in the CLI

Configuring variables in a file

1. Open the MariaDB configuration file:
   • For Windows:C:\Program Files\MariaDB 11.5\data\my.ini
   • For Linux:/etc/my.cnf or /etc/mysql/my.cnf
2. Add the following lines to enable auditing:
   Copy to Clipboard

   plugin_load_add = server_audit
   server_audit=FORCE_PLUS_PERMANENT
   server_audit_logging = ON
   server_audit_file_path = C:/Program Files/MariaDb 11.5/data/server_audit.log 
   server_audit_events = CONNECT,QUERY,QUERY_DDL,QUERY_DML,QUERY_DCL

Configuring Variables in the CLI

1. Connect to MariaDB CLI

   Open MySQL Client or execute:

   Copy to Clipboard

   mysql -u [username] -p [password]

2. Install the audit plugin:
   Copy to Clipboard

   INSTALL SONAME 'server_audit';

3. To see a list of audit plugin-related variables on the server and their values, execute the follow while connected to the server:
   Copy to Clipboard

   SHOW GLOBAL VARIABLES LIKE 'server_audit%';

4. To have the audit plugin log more than one type of event, put them in a comma-separated list and execute the below command:
   Copy to Clipboard

   SET GLOBAL server_audit_events = 'CONNECT,QUERY,QUERY_DDL,QUERY_DML,QUERY_DCL';

Audited events

Here are the types of audited events captured from MariaDB in Log360 Cloud:

Category	Events
DDL auditing	Database created, Database dropped, Tables created, Tables dropped, Tables altered, Procedures created, Procedures dropped, Procedures altered, Index created, Index dropped, Triggers created, Triggers dropped, Views created, Views dropped, Views altered, Function created, Function dropped, Function altered
DML auditing	Select queries, Insert queries, Update queries, Delete queries, Truncate queries
Execution analysis	Failed queries
Auditing account management	Role created, Role dropped, Role updated, Grant operations, Revoke operations, Password changed, User created, User dropped, User updated, Failed account management queries
Logon events	User logon, Failed user logon, User logoff, Logon/logoff trends
Server events	Startup, Shutdown
Administrative statements	SET and SHOW statements, Transaction and Locking statements, Utility statements, Replication statements, Table maintenance statements, Plugin statements

Configuring in Log360 Cloud

After installing the MariaDB extension in Log360 Cloud, configure the scheduled import for the server_audit.log file from the MariaDB Server file path. Ensure that the correct file path is used during configuration.

Navigate to Settings → Configuration Settings → Log Source Configuration → Import Logs → From Device

Viewing MariaDB reports

To view MariaDB reports, navigate to the Reports tab and select MariaDB from the Custom Reports sub-tab.

Enable MariaDB correlation rules

To view the correlation rules, navigate to the Correlation tab -> Manage Rules.

In the Manage Rules page, select MariaDB as the Rule Category to filter out the related correlation rules. You can enable them manually by selecting the rule and clicking on Activate in the Rule Status column.

Enabling MariaDB Alerts

To view the Alerts, navigate to the Alerts tab -> Manage Alert Profiles.

1. In the Manage Alert Profiles page, select Custom Alert Profiles as the Alert Profile Type. Click the search icon and add MariaDB to filter out the alert profile(s). Select the profile(s) and click the green check mark icon to enable the alert profile.



2. To associate the log source, click the edit icon to open the Edit Alert Profile window. In the Log Source field, click the add button and select the configured log source for MariaDB. Click Update to save the changes.