Track database activity with Audit Logs in Azure Database for MySQL - Flexible Server

APPLIES TO: Azure Database for MySQL - Flexible Server

Azure Database for MySQL flexible server provides users with the ability to configure audit logs. Audit logs can be used to track database-level activity including connection, admin, DDL, and DML events. These types of logs are commonly used for compliance purposes.

Configure audit logging

By default, audit logs are disabled. To enable them, set the audit_log_enabled server parameter to ON. This can be configured using the Azure portal or Azure CLI.

Other parameters you can adjust to control audit logging behavior include:

• audit_log_events: controls the events to be logged. See below table for specific audit events.
• audit_log_include_users: MySQL users to be included for logging. The default value for this parameter is empty, which will include all the users for logging. This has higher priority over audit_log_exclude_users. Max length of the parameter is 512 characters. For example, wildcard value of dev* includes all the users with entries starting with keyword dev like "dev1,dev_user,dev_2". Another example for wildcard entry for including user is *dev in this example, all users ending with value "dev" like "stage_dev,prod_dev,user_dev" are included in the audit log entries. Additionally, the use of a question mark (?) as a wildcard character is permitted in patterns.
• audit_log_exclude_users: MySQL users to be excluded from logging. The Max length of the parameter is 512 characters. Wildcard entries for user are also accepted to exclude users in audit logs. For example, wildcard value of stage* excludes all the users with entries starting with keyword stage like "stage1,stage_user,stage_2". Another example for wildcard entry for excluding user is *com in this example, all users ending with value com will be excluded from the audit log entries. Additionally, the use of a question mark (?) as a wildcard character is permitted in patterns.

Access audit logs

Audit logs are integrated with Azure Monitor diagnostic settings. Once you've enabled audit logs on your flexible server, you can emit them to Azure Monitor logs, Azure Event Hubs, or Azure Storage. To learn more about diagnostic settings, see the diagnostic logs documentation. To learn more about how to enable diagnostic settings in the Azure portal, see the audit log portal article.

The following sections describe the output of MySQL audit logs based on the event type. Depending on the output method, the fields included and the order in which they appear may vary.

Connection

General

Schema below applies to GENERAL, DML_SELECT, DML_NONSELECT, DML, DDL, DCL, and ADMIN event types.

Table access

Analyze logs in Azure Monitor Logs

Once your audit logs are piped to Azure Monitor Logs through Diagnostic Logs, you can perform further analysis of your audited events. Below are some sample queries to help you get started. Make sure to update the below with your server name.

• List GENERAL events on a particular server

  AzureDiagnostics
  | where Resource  == '<your server name>' //Server name must be in Upper case
  | where Category == 'MySqlAuditLogs' and event_class_s == "general_log"
  | project TimeGenerated, Resource, event_class_s, event_subclass_s, event_time_t, user_s , ip_s , sql_text_s
  | order by TimeGenerated asc nulls last
  

• List CONNECTION_V2 events on a particular server, status_d column denotes the client connection error code faced by the client application while connecting.

  AzureDiagnostics
  | where Resource  == '<your server name>' //Server name must be in Upper case
  | where Category == 'MySqlAuditLogs' and event_subclass_s == "CONNECT"
  | project TimeGenerated, Resource, event_class_s, event_subclass_s, user_s, ip_s, status_d
  | order by TimeGenerated asc nulls last
  

• List CONNECTION events on a particular server

  AzureDiagnostics
  | where Resource  == '<your server name>' //Server name must be in Upper case
  | where Category == 'MySqlAuditLogs' and event_class_s == "connection_log"
  | project TimeGenerated, Resource, event_class_s, event_subclass_s, event_time_t, user_s , ip_s , sql_text_s
  | order by TimeGenerated asc nulls last
  

• Summarize audited events on a particular server

  AzureDiagnostics
  | where Resource  == '<your server name>' //Server name must be in Upper case
  | where Category == 'MySqlAuditLogs'
  | project TimeGenerated, Resource, event_class_s, event_subclass_s, event_time_t, user_s , ip_s , sql_text_s
  | summarize count() by event_class_s, event_subclass_s, user_s, ip_s
  

• Graph the audit event type distribution on a particular server

  AzureDiagnostics
  | where Resource  == '<your server name>' //Server name must be in Upper case
  | where Category == 'MySqlAuditLogs'
  | project TimeGenerated, Resource, event_class_s, event_subclass_s, event_time_t, user_s , ip_s , sql_text_s
  | summarize count() by Resource, bin(TimeGenerated, 5m)
  | render timechart
  

• List audited events across all Azure Database for MySQL flexible server instances with Diagnostic Logs enabled for audit logs

  AzureDiagnostics
  | where Category == 'MySqlAuditLogs'
  | project TimeGenerated, Resource, event_class_s, event_subclass_s, event_time_t, user_s , ip_s , sql_text_s
  | order by TimeGenerated asc nulls last
  

Next steps

• Learn more about slow query logs
• Configure auditing