Mysql 纪录用户操作日志

我们想追踪某个数据库操作记录，如想找出是谁操作了某个表（比如谁将字段名改了）。

二进制日志记录了操作记录，线程号等信息，但是却没有记录用户信息，因此需要结合init-connect来实现追踪。

init-connect，在每次连接的初始化阶段，记录下这个连接的用户，和connection_id信息。

操作如下：

 1:建监控连接信息的表
 use dba;
 create table accesslog(`thread_id` int primary key auto_increment, `time` timestamp, `localname` varchar(40), `machine_name` varchar(40));  

 2：设置变量init_connect  

 mysql> show variables like 'init%';
 +---------------+-------+
 | Variable_name | Value |
 +---------------+-------+
 | init_connect  |       |
 | init_file     |       |
 | init_slave    |       |
 +---------------+-------+
 3 rows in set (0.00 sec)  

 mysql> set global init_connect='insert into dba.accesslog(thread_id,time,localname,machine_name) values(connection_id(),now(),user(),current_user());';
 Query OK, 0 rows affected (0.00 sec)  

 mysql> show variables like 'init%';
 +---------------+-----------------------------------------------------------------------------------------------------------------------+
 | Variable_name | Value                                                                                                                 |
 +---------------+-----------------------------------------------------------------------------------------------------------------------+
 | init_connect  | insert into dba.accesslog(thread_id,time,localname,machine_name) values(connection_id(),now(),user(),current_user()); |
 | init_file     |                                                                                                                       |
 | init_slave    |                                                                                                                       |
 +---------------+-----------------------------------------------------------------------------------------------------------------------+
 3 rows in set (0.00 sec)  

 3：分配用户权限
 mysql> grant select,insert,update on dba.accesslog to baidandan@'192.168.9.45' identified by 'baidandan';
 Query OK, 0 rows affected (0.00 sec)  

  --为了做实验，给baidandan赋予操作dba.t表的权限
 mysql> grant select,delete on dba.t to baidandan@'192.168.9.45';
 Query OK, 0 rows affected (0.00 sec)  

 4：测试
 --客户端连接进行测试
 C:\Users\dandan>mysql -u baidandan -p -h 192.168.6.51
 Enter password: *********
 Welcome to the MySQL monitor.  Commands end with ; or \g.
 Your MySQL connection id is 371
 Server version: 5.6.20-r5436-log Source distribution  

 Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.  

 Oracle is a registered trademark of Oracle Corporation and/or its
 affiliates. Other names may be trademarks of their respective
 owners.  

 Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.  

 mysql> use dba;
 Database changed
 mysql> delete from t;
 Query OK, 1 row affected (0.10 sec)  

 mysql> commit;
 Query OK, 0 rows affected (0.00 sec)  

 mysql> select * from t;
 Empty set (0.00 sec)  

 假如我现在想看是谁把DBA.t表里的数据给删掉了。
 查看日志：
 mysql> show master status;
 +------------------+----------+--------------+------------------+-------------------+
 | File             | Position | Binlog_Do_DB | Binlog_Ignore_DB | Executed_Gtid_Set |
 +------------------+----------+--------------+------------------+-------------------+
 | mysql-bin.000007 |     1640 |              |                  |                   |
 +------------------+----------+--------------+------------------+-------------------+
 1 row in set (0.00 sec)  

 --假如我知道这个数据是在6月18号9点后被删除的：
 [root@ser6-51 data]# mysqlbinlog mysql-bin.000007 --start-datetime='2015-06-18 09:00:00'  

 --查到删除的语句：
 #150618 16:55:30 server id 1  end_log_pos 1609 CRC32 0xa2296c53 Query thread_id=371 exec_time=0 error_code=0
 use `dba`/*!*/;
 SET TIMESTAMP=1434617730/*!*/;
 delete from t
 /*!*/;  

 --查询accesslog表
 mysql> select * from dba.accesslog where thread_id=371;
 +-----------+---------------------+------------------------+------------------------+
 | thread_id | time                | localname              | machine_name           |
 +-----------+---------------------+------------------------+------------------------+
 |       371 | 2015-06-18 16:55:19 | baidandan@192.168.9.45 | baidandan@192.168.9.45 |
 +-----------+---------------------+------------------------+------------------------+
 1 row in set (0.00 sec)
 注意： 对于所有的普通级别的用户，必须全部都要对日志表具有读写权限， 否则将导致，没有权限的用户无法使用数据库。

  init_connect 不会记录有超级管理员权限的用户连接信息 (原因:当init_connect设置有误时,超级管理员可进行修改)

 因此，对于一般的用户，不能赋予all privileges权限。

  --如果想查看所有的增删改查记录，在general log（需要先开启）里查询即可。里面记录了连接的用户和IP信息。如：

 2016-10-08T12:09:58.476859Z   57 Connect
 baidandan@10.0.9.121 on dba using TCP/IP