Post cover image

October 28, 2026

MySQL audit logs & Wazuh SIEM Integration

Overview

By Aravind Raja

3 min read

Overview

Logging and auditing database activities are critical for security monitoring, compliance, and incident investigation. Organizations rely on audit logs to track who accessed the database, what queries were executed, and whether any unauthorized actions occurred. However, enabling comprehensive auditing in MySQL Community Edition presents certain challenges because advanced auditing capabilities are primarily included in enterprise editions.

MySQL Community Edition provides few basic logging mechanisms such as:

  • General Query log
  • Slow Query log
  • Error log

While these logs capture operational details, they do not provide true audit-level visibility.

Architecture and working mechanism:

The Percona audit plugin works by hooking into MySQL audit functions and intercepting database events, when configured as followed:

  • Plugin registers with MySQL server
  • It listens for DB activities
  • Events are formatted into structured logs
  • Logs are written to a file

This architecture allows for real-time monitoring of database operations without modifying application logic.

Pre-requisites:

  • MySQL community edition
  • Percona audit plugin package (audit_log.so)
  • Wazuh SIEM

Percona Audit Plugin Deployment Approach for production environment:

To enable advanced auditing capabilities in MySQL using the Percona audit plugin (audit_log.so), a full installation of the Percona Server distribution on the production environment is not required.

Instead, the deployment can be performed using a minimal and controlled approach:

  • The audit_log.so plugin library can be copied directly into the MySQL plugin directory (as defined by the plugin_dir system variable).
  • No additional packages, services, or third-party binaries need to be installed on the production server.
  • This approach minimizes changes to the production environment and aligns with restrictions where installing external software is not permitted.
  • We can install the percona server in a test server and the audit_log.so alone can be copied to the production server within the plugin_dir.

Install Percona Audit Plugin in the MySQL server

  • Update the package lists for upgrades & new package installation
sudo apt update
  • Use CURL to download the percona packages
curl -O https://repo.percona.com/apt/percona-release_latest.generic_all.deb
  • Install packages includes lsb-release
sudo apt install gnupg2 lsb-release ./percona-release_latest.generic_all.deb
  • Update the downloaded packages and their dependencies
sudo apt update
  • Uses percona-release command, a tool provided by Percona, to set up a specific Percona Server version.
sudo percona-release setup ps80
  • Install the Percona Server
sudo apt install percona-server-server

Changes in the Database:

  • Locate the plugin directory after logging into mysql
None
  • After installing percona you will be able to see the audit_log.so plugin in the directory /usr/lib/mysql/plugin/
None
  • Install the plugin using below statement in mysql shell
install plugin audit_log soname 'audit_log.so';
None
  • Ensure the plugin installation
show plugins;
None
  • Check the audit plugin status using below command
select * from information_schema.plugins where plugin_name='audit_log'\G
None

Check the properties of audit_plugin

  1. The audit_log_format should be json, by default its OLD change it to json using the steps mentioned below
  2. Ensure the file audit.log file is created.
  3. Show global variables like 'audit%';
None None
  • Locating the log file
None None

Integrating MySQL Audit logs with Wazuh SIEM for DAM

  • Paste the below rule in local_rules.xml file in Wazuh server or configure it though dashboard
None 
<group name="mysql_audit">
  <rule id="100200" level="5">
    <decoded_as>json</decoded_as>
    <field name="audit_record.name">\.+</field>
    <description>MySQL Audit Log Event Detected</description>
    <group>mysql,audit</group>
  </rule>
</group>
  • The above rule is a generic or comprehensive rule which can parse MySQL logs with json format.
  • The mysql server installed with the Wazuh agent, configure the ossec.conf file to collect the audit logs — Either configure at the agent level or global configuration
None
  • After save and restart the wazuh manager
  • Below are the sample alerts
None None

REFERENCE: