Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have mysql server.

The server is accessed by my application, and by external auditor (person using mysql workbench).
The auditor has specific user and password and dedicated IP and it is granted only for select privileges.

I need to log the activities from the auditor.

I have read similar questions here on serverfault, but I did not saw any acceptable answers that it is possible to do sql logging by the sql server only for a specific user.

But is it possible and how, to log the network packages from the auditors IP, but only the text (the queries), not the complete packages ?

Any other solutions how can I monitor what the auditor was doing on the server ?

share|improve this question

1 Answer 1

But is it possible and how, to log the network packages from the auditors IP, but only the text (the queries), not the complete packages?

Yes, it is possible:

tcpdump -s0 -i eth0 src host auditors.ip and dst port 3306 -w mysql.pcap

then you can filter only the MySQL queries by running:

while read stream; do \
tshark -qz follow,tcp,ascii,$stream -r mysql.pcap; done \
< <(tshark -R "mysql" -T fields -e tcp.stream -r mysql.pcap | sort | uniq)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.