Audit log - MySQL setup

This page shows how to prepare a MySQL server for the audit log. MySQL 8.0 and later is supported.

Creating the database and the user

As an administrative user, create a database named zato_audit_log with the utf8mb4 character set, and a user of the same name with full rights to that database. The audit log creates its table and indexes the first time a server connects.

Now, point the servers at the database:

export Zato_Audit_Log_DB_Type=mysql
export Zato_Audit_Log_DB_Host=db.example.com
export Zato_Audit_Log_DB_Port=3306
export Zato_Audit_Log_DB_Username=zato_audit_log
export Zato_Audit_Log_DB_Password=my.secret.password
export Zato_Audit_Log_DB_Name=zato_audit_log

Enabling SSL/TLS on the server

Point MySQL at its certificate files in my.cnf:

[mysqld]
ssl_ca   = /etc/mysql/certs/ca.crt
ssl_cert = /etc/mysql/certs/server.crt
ssl_key  = /etc/mysql/certs/server.key

To refuse all unencrypted TCP connections, add:

[mysqld]
require_secure_transport = ON

Alternatively, mark the zato_audit_log account as requiring SSL, which enforces TLS for that user alone, or as requiring X.509, which additionally demands a client certificate (mutual TLS).

With the server prepared, enable TLS on the client side:

export Zato_Audit_Log_DB_SSL=on
export Zato_Audit_Log_DB_SSL_CA_File=/path/to/ca.crt

And, when the user requires a client certificate:

export Zato_Audit_Log_DB_SSL_Cert_File=/path/to/client.crt
export Zato_Audit_Log_DB_SSL_Key_File=/path/to/client.key

All the client-side variables are described in the audit log documentation.

Learn more