Configure and access Azure Database for MariaDB audit logs in the Azure CLI

Important

Azure Database for MariaDB is on the retirement path. We strongly recommend that you migrate to Azure Database for MySQL. For more information about migrating to Azure Database for MySQL, see What's happening to Azure Database for MariaDB?.

You can configure the Azure Database for MariaDB audit logs from the Azure CLI.

If you don't have an Azure subscription, create an Azure free account before you begin.

Prerequisites

To complete this guide:

• You need an Azure Database for MariaDB server.

• Use the Bash environment in Azure Cloud Shell. For more information, see Quickstart for Bash in Azure Cloud Shell.

  

• If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.

  • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.

  • When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.

  • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

• This article requires version 2.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.

Configure audit logging

Important

It is recommended to only log the event types and users required for your auditing purposes to ensure your server's performance is not heavily impacted.

Enable and configure audit logging using the following steps:

1. Turn on audit logs by setting the audit_logs_enabled parameter to "ON".

   az mariadb server configuration set --name audit_log_enabled --resource-group myresourcegroup --server mydemoserver --value ON
   

2. Select the event types to be logged by updating the audit_log_events parameter.

   az mariadb server configuration set --name audit_log_events --resource-group myresourcegroup --server mydemoserver --value "ADMIN,CONNECTION"
   

3. Add any MariaDB users to be excluded from logging by updating the audit_log_exclude_users parameter. Specify users by providing their MariaDB user name.

   az mariadb server configuration set --name audit_log_exclude_users --resource-group myresourcegroup --server mydemoserver --value "azure_superuser"
   

4. Add any specific MariaDB users to be included for logging by updating the audit_log_include_users parameter. Specify users by providing their MariaDB user name.

   az mariadb server configuration set --name audit_log_include_users --resource-group myresourcegroup --server mydemoserver --value "sampleuser"
   

Next steps

• Learn more about audit logs in Azure Database for MariaDB
• Learn how to configure audit logs in the Azure portal