clicktail icon indicating copy to clipboard operation
clicktail copied to clipboard

syslog parsing of audit logs.

Open Lenny-hos-stofa opened this issue 5 years ago • 0 comments

If the MySQL Audit is outputting to syslog, the logfile will also contain a header with:

  • extra timestamp
  • syslog hostname
  • syslog identifier

This new version of the mysqlaudit parser is able to handle this header. Also the hostname is imported into clickhouse, which is a benefit if you receive audit log from several database servers. Please note there is a new column (dbserver) added to the mysql_audit_logs schema.

Lenny-hos-stofa avatar Sep 09 '19 17:09 Lenny-hos-stofa