From da8656c8055460fd1a38f6e85706c99f98efbb40 Mon Sep 17 00:00:00 2001 From: guylichtman Date: Sun, 11 Mar 2012 08:32:16 -0700 Subject: [PATCH] Created Installation (markdown) --- Installation.md | 63 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 Installation.md diff --git a/Installation.md b/Installation.md new file mode 100644 index 0000000..e81666d --- /dev/null +++ b/Installation.md @@ -0,0 +1,63 @@ +Download the latest binary release from: https://github.com/mcafee/mysql-audit/downloads + +Make sure to download the proper binary distribution. There are separate binaries for MySQL 5.1 and MySQL 5.5 according +to platform (32 or 64 bit). + +The Plugin file is available in the zip binary distribution under the lib dir. File name: libaudit\_plugin.so. To install AUDIT Plugin, copy libaudit\_plugin.so to the plugin\_dir (for example _/usr/lib/mysql/plugin_ or _/usr/lib64/mysql/plugin_ ) of MySQL. + +To see the configured plugin dir, login to MySQL and issue the following command: + + show global variables like 'plugin_dir'; + +There are 2 options for installing the plugin via plugin-load configuration option or by issuing the +INSTALL PLUGIN statement. + +### Installing via: plugin-load + +Add to the MySQL option file (my.cnf) at the [mysqld] section the option: + + plugin-load=AUDIT=libaudit_plugin.so + +Restart the mysqld server for the changes to take effect. + +### Installing via: INSTALL PLUGIN + +You will need to issue the following sql command to install the plugin: + + INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so'; + +A restart to the mysqld server is not necessary. + +Note: On production systems, McAfee recommends using the plugin-load option for installing +the audit plugin. + +More info on installing MySQL plugins is available at: +http://dev.mysql.com/doc/refman/5.1/en/plugin-installing-uninstalling.html + +### Verification + +To check if the plugin is installed successfully you can issue the following command, which will show all installed plugins: + + show plugins; + +The AUDIT plugin will show up with the name AUDIT. Additionally you can verify the version of the AUDIT Plugin by running the following command: + + show global status like 'AUDIT_version'; + +### Troubleshooting + +IF the AUDIT plugin fails to install error messages will be logged in the MySQL error log. Log file location can be queried in MySQL by running the following command: + + show global variables like 'log_error'; + +**Common issue with checksum validation:** AUDIT plugin uses compiled offsets for accessing built-in MySQL data structures that are not exposed through a consistent API. The use of offsets is used for supporting multiple MySQL versions with a single binary distribution. The plugin will use the proper offsets according to the MySQL server version. To verify that the plugin is running on a MySQL version which we know and tested the offsets for, we've added a checksum verification on the mysqld binary. Thus, if a MySQL server distribution, which we haven't extracted the offsets and checksum for, is being used, the plugin will fail installation as the checksum of mysqld will not match a known checksum. Usually, the offsets between different MySQL distributions are the same for a specific version. Thus, it is possible to run the AUDIT plugin with the offsets of a specific MySQL server version without checksum verification. If checksum verification fails the log will contain an error of the form: + +> Audit Plugin: Couldn't find proper THD offsets for: MYSQL_VERSION + +In this case, you can try to disable the checksum verification. To disable checksum verification: add to the MySQL option file (my.cnf) at the [mysqld] section the option: + + audit_validate_checksum=OFF + +Then try installing the AUDIT plugin either via plugin-load configuration option (restart) or by issuing the INSTALL PLUGIN statement. + +