Mysql记录用户操作日志

我们想追踪某个数据库操作记录，如想找出是谁操作了某个表（比如谁将字段名改了）。

二进制日志记录了操作记录，线程号等信息，但是却没有记录用户信息，因此需要结合init-connect来实现追踪。

init-connect，在每次连接的初始化阶段，记录下这个连接的用户，和connection_id信息。

操作如下：

1:建监控连接信息的表  
use dba;  
create table accesslog(`thread_id` int primary key auto_increment, `time` timestamp, `localname` varchar(40), `machine_name` varchar(40));  
  
  
2：设置变量init_connect  
   
mysql> show variables like 'init%';  
+---------------+-------+  
| Variable_name | Value |  
+---------------+-------+  
| init_connect  |       |  
| init_file     |       |  
| init_slave    |       |  
+---------------+-------+  
3 rows in set (0.00 sec)  
   
mysql> set global init_connect='insert into dba.accesslog(thread_id,time,localname,machine_name) values(connection_id(),now(),user(),current_user());';  
Query OK, 0 rows affected (0.00 sec)  
   
mysql> show variables like 'init%';  
+---------------+-----------------------------------------------------------------------------------------------------------------------+  
| Variable_name | Value                                                                                                                 |  
+---------------+-----------------------------------------------------------------------------------------------------------------------+  
| init_connect  | insert into dba.accesslog(thread_id,time,localname,machine_name) values(connection_id(),now(),user(),current_user()); |  
| init_file     |                                                                                                                       |  
| init_slave    |                                                                                                                       |  
+---------------+-----------------------------------------------------------------------------------------------------------------------+  
3 rows in set (0.00 sec)  
   
   
3：分配用户权限  
mysql> grant select,insert,update on dba.accesslog to baidandan@'192.168.9.45' identified by 'baidandan';  
Query OK, 0 rows affected (0.00 sec)  
   
 --为了做实验，给baidandan赋予操作dba.t表的权限  
mysql> grant select,delete on dba.t to baidandan@'192.168.9.45';  
Query OK, 0 rows affected (0.00 sec)  
  
4：测试  
--客户端连接进行测试  
C:Usersdandan>mysql -u baidandan -p -h 192.168.6.51  
Enter password: *********  
Welcome to the MySQL monitor.  Commands end with ; or g.  
Your MySQL connection id is 371  
Server version: 5.6.20-r5436-log Source distribution  
  
  
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.  
  
  
Oracle is a registered trademark of Oracle Corporation and/or its  
affiliates. Other names may be trademarks of their respective  
owners.  
  
  
Type 'help;' or 'h' for help. Type 'c' to clear the current input statement.  
  
  
mysql> use dba;  
Database changed  
mysql> delete from t;  
Query OK, 1 row affected (0.10 sec)  
  
  
mysql> commit;  
Query OK, 0 rows affected (0.00 sec)  
  
  
mysql> select * from t;  
Empty set (0.00 sec)  
  
  
假如我现在想看是谁把DBA.t表里的数据给删掉了。  
查看日志：  
mysql> show master status;  
+------------------+----------+--------------+------------------+-------------------+  
| File             | Position | Binlog_Do_DB | Binlog_Ignore_DB | Executed_Gtid_Set |  
+------------------+----------+--------------+------------------+-------------------+  
| mysql-bin.000007 |     1640 |              |                  |                   |  
+------------------+----------+--------------+------------------+-------------------+  
1 row in set (0.00 sec)  
  
--假如我知道这个数据是在6月18号9点后被删除的：  
[root@ser6-51 data]# mysqlbinlog mysql-bin.000007 --start-datetime='2015-06-18 09:00:00'  
  
--查到删除的语句：  
#150618 16:55:30 server id 1  end_log_pos 1609 CRC32 0xa2296c53 Query thread_id=371 exec_time=0 error_code=0  
use `dba`/*!*/;  
SET TIMESTAMP=1434617730/*!*/;  
delete from t  
/*!*/;  
  
--查询accesslog表  
mysql> select * from dba.accesslog where thread_id=371;  
+-----------+---------------------+------------------------+------------------------+  
| thread_id | time                | localname              | machine_name           |  
+-----------+---------------------+------------------------+------------------------+  
|       371 | 2015-06-18 16:55:19 | baidandan@192.168.9.45 | baidandan@192.168.9.45 |  
+-----------+---------------------+------------------------+------------------------+  
1 row in set (0.00 sec)  
注意： 对于所有的普通级别的用户，必须全部都要对日志表具有读写权限， 否则将导致，没有权限的用户无法使用数据库。

 init_connect 不会记录有超级管理员权限的用户连接信息 (原因:当init_connect设置有误时,超级管理员可进行修改)

因此，对于一般的用户，不能赋予all privileges权限。

 --如果想查看所有的增删改查记录，在general log（需要先开启）里查询即可。里面记录了连接的用户和IP信息。如：

2016-10-08T12:09:58.476859Z   57 Connect
baidandan@10.0.9.121 on dba using TCP/IP