clicktail
clicktail copied to clipboard
syslog parsing of audit logs.
If the MySQL Audit is outputting to syslog, the logfile will also contain a header with:
- extra timestamp
- syslog hostname
- syslog identifier
This new version of the mysqlaudit parser is able to handle this header. Also the hostname is imported into clickhouse, which is a benefit if you receive audit log from several database servers. Please note there is a new column (dbserver) added to the mysql_audit_logs schema.