记录mysql的具体操作明细

在MySQL中使用init-connect与binlog来实现用户操作追踪记录 2014-07-28 20:55:38

分类： MySQL

前言：
测试环境莫名其妙有几条重要数据被删除了，由于在binlog里面只看到是公用账号删除的，无法查询是那个谁在那个时间段登录的，就考虑怎么记录每一个MYSQL账号的登录信息，在MYSQL中，每个连接都会先执行init-connect，进行连接的初始化，我们可以在这里获取用户的登录名称和thread的ID值。然后配合binlog，就可以追踪到每个操作语句的操作时间，操作人以及客户端的连接进程信息等。实现审计。

1，在mysql服务器db中建立单独的记录访问信息的库
set names utf8;
create database access_log;
CREATE TABLE `access_log` 
(
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `thread_id` int(11) DEFAULT NULL, -- 线程ID，这个值很重要
  `log_time` timestamp NOT NULL DEF AULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, -- 登录时间
  `localname` varchar(30) DEFAULT NULL, -- 登录名称
  `matchname` varchar(30) DEFAULT NULL, -- 登录用户
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8 comment ‘录入用户登录信息‘;

2，在配置文件中配置init-connect参数。登录时插入日志表。如果这个参数是个错误的SQL语句，登录就会失败。
vim /usr/local/mysql/my.cnf
init-connect=‘INSERT INTO access_log.access_log VALUES(NULL,CONNECTION_ID(),NOW(),USER(),CURRENT_USER());‘
然后重启数据库

3，创建普通用户，不能有super权限，而且用户必须有对access_log库的access_log表的insert权限，否则会登录失败。
给登录用户赋予insert权限，但是不赋予access_log的insert、select权限，
GRANT INSERT,DELETE,UPDATE,SELECT ON test.* TO [email protected]‘%‘ IDENTIFIED BY ‘cacti_user1603‘;
mysql> GRANT CREATE,DROP,ALTER,INSERT,DELETE,UPDATE,SELECT ON test.* TO [email protected]‘%‘ IDENTIFIED BY ‘cacti_user1603‘;
Query OK, 0 rows affected (0.00 sec)
mysql> exit
然后去用新的audit_user登录操作
[[email protected]_server ~]# /usr/local/mysql/bin/mysql  -uaudit_user -p -S /usr/local/mysql/mysql.sock
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 25
Server version: 5.6.12-log

Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type ‘help;‘ or ‘\h‘ for help. Type ‘\c‘ to clear the current input statement.

mysql> lect * from access_log.access_log;
ERROR 2006 (HY000): MySQL server has gone away
No connection. Trying to reconnect...
Connection id:    26
Current database: *** NONE ***

ERROR 1184 (08S01): Aborted connection 26 to db: ‘unconnected‘ user: ‘audit_user‘ host: ‘localhost‘ (init_connect command failed)
mysql> 
看到报错信息 (init_connect command failed)，再去错误日志error log验证一下：
tail -fn 5 /usr/local/mysql/mysqld.log 
2014-07-28 16:03:31 23743 [Warning] Aborted connection 25 to db: ‘unconnected‘ user: ‘audit_user‘ host: ‘localhost‘ (init_connect command failed)
2014-07-28 16:03:31 23743 [Warning] INSERT command denied to user ‘‘@‘localhost‘ for table ‘access_log‘
2014-07-28 16:04:04 23743 [Warning] Aborted connection 26 to db: ‘unconnected‘ user: ‘audit_user‘ host: ‘localhost‘ (init_connect command failed)
2014-07-28 16:04:04 23743 [Warning] INSERT command denied to user ‘‘@‘localhost‘ for table ‘access_log‘
看到必须要有对access_log库的access_log表的insert权限才行。

4，赋予用户access_log的insert、select权限，然后重新赋予权限：
GRANT SELECT,INSERT ON access_log.* TO [email protected]‘%‘;
mysql> 
mysql> GRANT SELECT,INSERT ON access_log.* TO [email protected]‘%‘;
Query OK, 0 rows affected (0.00 sec)

mysql> exit
Bye

再登录，报错如下：
[[email protected]_server ~]# /usr/local/mysql/bin/mysql  -uaudit_user -p -S /usr/local/mysql/mysql.sock
Enter password: 
ERROR 1045 (28000): Access denied for user ‘audit_user‘@‘localhost‘ (using password: YES)
[[email protected]_server ~]#

去查看error日志：
2014-07-28 16:15:29 23743 [Warning] INSERT command denied to user ‘‘@‘localhost‘ for table ‘access_log‘
2014-07-28 16:15:41 23743 [Warning] Aborted connection 37 to db: ‘unconnected‘ user: ‘audit_user‘ host: ‘localhost‘ (init_connect command failed)
2014-07-28 16:15:41 23743 [Warning] INSERT command denied to user ‘‘@‘localhost‘ for table ‘access_log‘
2014-07-28 16:15:50 23743 [Warning] Aborted connection 38 to db: ‘unconnected‘ user: ‘audit_user‘ host: ‘localhost‘ (init_connect command failed)
2014-07-28 16:15:50 23743 [Warning] INSERT command denied to user ‘‘@‘localhost‘ for table ‘access_log‘

需要用root用户登录进去，清空掉用户为‘‘的用户记录。
 mysql> select user,host,password from mysql.user;
+----------------+-----------+-------------------------------------------+
| user           | host      | password                                  |
+----------------+-----------+-------------------------------------------+
| root           | localhost |                                           |
| root           | db_server   |                                           |
| root           | 127.0.0.1 |                                           |
| root           | ::1       |                                           |
|                | localhost |                                           |
|                | db_server   |                                           |
| cacti_user     | %         | *EB9E3195E443D577879101A35EF64A701B35F949 |
| cacti_user     | 1         | *D5FF9B53A78232DA13D3643965A5961449B387DB |
| cacti_user     | 2         | *D5FF9B53A78232DA13D3643965A5961449B387DB |
| test_user      | 192.%     | *8A447777509932F0ED07ADB033562027D95A0F17 |
| test_user      | 1         | *8A447777509932F0ED07ADB033562027D95A0F17 |
| weakpwd_user_1 | 10.%      | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
| weakpwd_user_2 | 10.%      | *B1461C9C68AFA1129A5F968C343636192A084ADB |
| weakpwd_user_3 | 10.%      | *DCB7DF5FFC82C441503300FFF165257BC551A598 |
| audit_user     | %         | *AEAB1915B137FAFDE9B949D67A9A42DDB68DD8A2 |
+----------------+-----------+-------------------------------------------+
15 rows in set (0.00 sec)

mysql> drop user ‘‘@‘localhost‘;
Query OK, 0 rows affected (0.00 sec)

mysql> drop user ‘‘@‘db_server‘;
Query OK, 0 rows affected (0.00 sec)

mysql>

再用已经分配了access_log表的Insert权限的audit_user登录
mysql> select * from access_log.access_log;
+----+-----------+---------------------+---------------------------+--------------+
| id | thread_id | log_time            | localname                 | matchname    |
+----+-----------+---------------------+---------------------------+--------------+
|  4 |        41 | 2014-07-28 16:19:37 | [email protected]      | [email protected]% |
|  5 |        42 | 2014-07-28 16:20:32 | [email protected]      | [email protected]% |
|  6 |        45 | 2014-07-28 16:21:11 | [email protected]      | [email protected]% |
+----+-----------+---------------------+---------------------------+--------------+
6 rows in set (0.00 sec)

mysql> show full processlist;
+----+------------+-----------+------+---------+------+-------+-----------------------+
| Id | User       | Host      | db   | Command | Time | State | Info                  |
+----+------------+-----------+------+---------+------+-------+-----------------------+
| 45 | audit_user | localhost | NULL | Query   |    0 | init  | show full processlist |
+----+------------+-----------+------+---------+------+-------+-----------------------+
1 row in set (0.00 sec)

mysql>

5，再用另外一个用户登录建表，录入测试数据。
建表录入数据记录
mysql> use test;
Database changed
mysql> create table t1 select 1 as a, ‘wa‘ as b;
Query OK, 1 row affected (0.01 sec)
Records: 1  Duplicates: 0  Warnings: 0

查看跟踪用户行为记录。
mysql> select * from access_log.access_log;
+----+-----------+---------------------+---------------------------+--------------+
| id | thread_id | log_time            | localname                 | matchname    |
+----+-----------+---------------------+---------------------------+--------------+
|  4 |        41 | 2014-07-28 16:19:37 | [email protected]      | [email protected]% |
|  5 |        42 | 2014-07-28 16:20:32 | [email protected]      | [email protected]% |
|  6 |        45 | 2014-07-28 16:21:11 | [email protected]      | [email protected]% |
|  7 |        48 | 2014-07-28 16:30:42 | [email protected]    | [email protected]% |
|  8 |        50 | 2014-07-28 16:46:11 | [email protected]    | [email protected]% |
+----+-----------+---------------------+---------------------------+--------------+
8 rows in set (0.00 sec)

去mysql db服务器上查看binlog 内容，解析完后，没有insert语句，怎么回事，去看my.cnf
#binlog-ignore-db=mysql                         # No sync databases
#binlog-ignore-db=test                          # No sync databases
#binlog-ignore-db=information_schema            # No sync databases
#binlog-ignore-db=performance_schema

原来是对test库有binlog过滤设置，全部注释掉。重启mysql库，重新来一遍，可以在看到binlog
在MySQL客户端上重新执行。
mysql> use test;
Database changed
mysql> insert into test.t1 select 5,‘t5‘;
Query OK, 1 row affected (0.00 sec)
Records: 1  Duplicates: 0  Warnings: 0

mysql> select * from access_log.access_log;
+----+-----------+---------------------+---------------------------+--------------+
| id | thread_id | log_time            | localname                 | matchname    |
+----+-----------+---------------------+---------------------------+--------------+
|  1 |        17 | 2014-07-28 15:41:04 | [email protected] | [email protected]% |
|  2 |        18 | 2014-07-28 15:41:05 | [email protected] | [email protected]% |
|  3 |        19 | 2014-07-28 15:41:05 | [email protected] | [email protected]% |
|  4 |        41 | 2014-07-28 16:19:37 | [email protected]      | [email protected]% |
|  5 |        42 | 2014-07-28 16:20:32 | [email protected]      | [email protected]% |
|  6 |        45 | 2014-07-28 16:21:11 | [email protected]      | [email protected]% |
|  7 |        48 | 2014-07-28 16:30:42 | [email protected]    | [email protected]% |
|  8 |        50 | 2014-07-28 16:46:11 | [email protected]    | [email protected]% |
|  9 |        56 | 2014-07-28 19:32:12 | [email protected]    | [email protected]% |
| 10 |         1 | 2014-07-28 20:02:56 | [email protected]    | [email protected]% |
+----+-----------+---------------------+---------------------------+--------------+
10 rows in set (0.00 sec)
看到thread_id为1

6，如何查看何跟踪用户行为记录。
去mysql数据库服务器上查看binlog，应该thread_id=1的binlog记录。
[[email protected]_server binlog]# /usr/local/mysql/bin/mysqlbinlog  --base64-output=DECODE-ROWS  mysql-bin.000018 -v>3.log
[[email protected]_server binlog]# vim 3.log
# at 1103
#140728 20:12:48 server id 72  end_log_pos 1175 CRC32 0xa323c00e        Query   thread_id=1     exec_time=0     error_code=0
SET TIMESTAMP=1406549568/*!*/;
BEGIN
/*!*/;
# at 1175
#140728 20:12:48 server id 72  end_log_pos 1229 CRC32 0xbb8ca914        Table_map: `access_log`.`t1` mapped to number 72
# at 1229
#140728 20:12:48 server id 72  end_log_pos 1272 CRC32 0x8eed1450        Write_rows: table id 72 flags: STMT_END_F
### INSERT INTO `access_log`.`t1`
### SET
###   @1=10
###   @2=‘w0‘
# at 1272
#140728 20:12:48 server id 72  end_log_pos 1303 CRC32 0x72b26336        Xid = 14
COMMIT/*!*/;

看到thread_id=1，然后，就可以根据thread_id=1来判断执行这条insert命令的来源，还可以在mysql服务器上执行show full processlist;来得到MySQL客户端的请求端口，
mysql> show full processlist;
+----+------------+-------------------+------+---------+------+-------+-----------------------+
| Id | User       | Host              | db   | Command | Time | State | Info                  |
+----+------------+-------------------+------+---------+------+-------+-----------------------+
|  1 | audit_user | 192.168.3.62:44657 | test | Sleep   |  162 |       | NULL                  |
|  3 | root       | localhost         | NULL | Query   |    0 | init  | show full processlist |
+----+------------+-------------------+------+---------+------+-------+-----------------------+
2 rows in set (0.00 sec)

mysql> 
看到Id为1的线程，端口是44657。

我们切换回mysql客户端，去查看端口是44657的是什么进程，如下所示：
[[email protected]_client ~]$ netstat -antlp |grep 44657
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 192.168.3.62:44657           192.168.1.12:3307            ESTABLISHED 6335/mysql          
[[email protected]_client ~]$

获取到该进程的PID 6335，再通过ps -eaf得到该进程所执行的命令，如下所示：
[[email protected]_client ~]$ ps -eaf|grep 6335
tim   6335 25497  0 19:59 pts/1    00:00:00 mysql -uaudit_user -p -h 192.168.1.12 -P3307
tim   6993  6906  0 20:16 pts/2    00:00:00 grep 6335
[[email protected]_client ~]$

最后查到是通过mysql客户端登陆连接的。加入这个6335是某个web工程的，那么，也可以根据ps -eaf命令查询得到web工程的进程信息。

http://blog.chinaunix.net/uid-24086995-id-168445.html

http://blog.itpub.net/26230597/viewspace-1240386

时间： 2024-10-06 09:55:19

记录mysql的具体操作明细的相关文章

记录MySQL的一些基础操作

MySQL建表操作 [email protected] 08:05:22> create table stu( -> id int(4) not null, -> name char(20) not null, -> age tinyint(2) not null default '0', -> dept varchar(16) default null -> ); Query OK, 0 rows affected (0.01 sec) [email protecte

MySQL查询in操作 查询结果按in集合顺序显示_Mysql_脚本之家

body { font-family: "Microsoft YaHei UI","Microsoft YaHei",SimSun,"Segoe UI",Tahoma,Helvetica,Sans-Serif,"Microsoft YaHei", Georgia,Helvetica,Arial,sans-serif,宋体, PMingLiU,serif; font-size: 10.5pt; line-height: 1.5;

mysql数据库表操作及授权

表操作:增删改查 把/etc/passwd文件的内容导入 passwd表里. mysql>load data infile"/etc/passwd" into table passwd fields terminated by ":"; 基于前面的passwd表,完成下列操作: 1:列出uid低于500且3个字母的用户 mysql> select name from passwd where uid<500 and name like "

mysql 命令行操作

导入数据库: 1 mysql>use ygeshop; ygeshop为数据库名 2 mysql>source 导入的文件名; 如我输入的命令行:mysql>source ygeshop.sql; 1. 显示数据库列表. show databases; 缺省有两个数据库:mysql和test. mysql库存放着mysql的系统和用户权限信息,我们改密码和新增用户,实际上就是对这个库进行操作. 2. 显示库中的数据表: use mysql; show tables; 3. 显示数据表的结

MFC 对MYSQL数据库相关操作

记得看过有人说,现在的软件基本上都是连着数据库的,如果一个软件没有跟数据库相连,基本没什么作用.虽然这种说法略显片面,但数据库之于软件的重要也是毋庸置疑的. MFC连接数据库应该不算是什么新鲜的命题了,方法是有好几种的,本人试了下,感觉利用MySQL提供的C语言API来进行操作蛮方便的,所以在此记录下相关的操作. 要用MySQL提供的C语言API,首先要包含API的头文件目录,也就是在MFC工程属性中的"包含目录"下添加MySQL安装目录的"include"文件夹.

mysql常见命令操作

MySql常用命令总结 1:使用SHOW语句找出在服务器上当前存在什么数据库:(大小写一样) mysql> SHOW DATABASES; (展示数据库时候用databases) 2:2.创建一个数据库MYSQLDATA (展示一个数据时候用database) mysql> CREATE DATABASE MYSQLDATA; (删除用drop database dbname) 3:选择你所创建的数据库 mysql> USE MYSQLDATA; (按回车键出现Database chan

Python对MySQL数据库的操作

Python中,可以使用MySQLdb模块连接到MySQL数据库,对MySQL数据库进行操作 [第一步] MySQL安装 参考文档: http://blog.csdn.net/Jerry_1126/article/details/20837397 [第二步]连接到MySQL 创建数据库 Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 5 Server version: 5.5

MySQL表更新操作

1.  使用insert语句向表插入一条新记录,语法是:insert into 表名 [(字段列表)] values(值列表). 2.  使用set 语句更新操作与字符集,例如setcharacter_set_client =latin1\gbk\utf8; 3.  使用delete语句删除表记录,例如delete from 表名 where 条件表达式: 4.  使用insert语句可以一次性地向表中批量插入多条记录,语句是:insert  into 表名 [(字段名)]values (值列表

搞定linux上MySQL编程（二）：MySQL语法基础操作

[版权声明:尊重原创,转载请保留出处:blog.csdn.net/shallnet,文章仅供学习交流,请勿用于商业用途] sql(structured query language)是一种数据库查询和程序设计语言,用于存取数据以及查询.更新和管理关系数据库系统. sql语言包含3部分: 1. 数据定义语言(DDL),用于定义和管理对象,例如数据库.数据表以及试图等.例如create.drop.alter等语句. 2. 数据操作语言(DML),用于操作数据库中数据,例如select. insert