Control: 4.4.3 Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL Database Server
Description
Enable audit_log_enabled on MySQL Servers
Enabling audit_log_enabled helps MySQL Database to log items such as connection attempts to the server, DDL/DML access, and more. Log data can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance.
Remediation
From Azure Portal
- Login to Azure Portal using https://portal.azure.com
- Select your Azure Database for MySQL server
- For each database, under the Settings section in the sidebar, select Server parameters
- Update the audit_log_enabled parameter to ON
- Under the Monitoring section in the sidebar, select Diagnostic settings.
- Provide a diagnostic setting name
- Specify which data sinks to send the audit logs (storage account, event hub, and/or Log Analytic workspace)
- Select "MySqlAuditLogs" as the log type
- Once you've configured the data sinks to pipe the audit logs to, you can click Save
- Access the audit logs by exploring them in the data sinks you configured. It may take up to 10 minutes for the logs to appear
Default Value
By default audit_log_enabled is set to OFF by default.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v150_4_4_3Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v150_4_4_3 --shareSQL
This control uses a named query:
mysql_server_audit_logging_enabled