---新建保存审计日志的目录
mkdir  /usr/local/mysql/mysql_logs/auditlog

chown mysql:mysql /usr/local/mysql/mysql_logs/auditlog/


--2.安装审计插件
SHOW GLOBAL VARIABLES LIKE 'plugin_dir';

INSTALL PLUGIN server_audit SONAME 'server_audit.so';

SELECT * from information_schema.plugins where plugin_name='server_audit';


SHOW GLOBAL VARIABLES LIKE 'server_audit%';

------3.修改mysql配置文件

vi /etc/my.cnf

server_audit	=FORCE_PLUS_PERMANENT
server_audit_events	='CONNECT,QUERY,TABLE'
server_audit_logging	=ON
server_audit_incl_users	=wind
server_audit_file_rotate_size	= 10G
server_audit_file_path	= /usr/local/mysql/mysql_logs/auditlog/server_audit.log


-----4.新建测试用户

GRANT ALL PRIVILEGES ON wind.t1 TO 'wind'@'%' IDENTIFIED BY 'wind' WITH GRANT OPTION;

flush privileges;

实战-mariadb审计