{"id":23532670,"url":"https://github.com/outbrain-inc/audit_login","last_synced_at":"2025-04-22T22:41:34.030Z","repository":{"id":10641542,"uuid":"12868363","full_name":"outbrain-inc/audit_login","owner":"outbrain-inc","description":"simple MySQL login audit plugin, logging to text file","archived":false,"fork":false,"pushed_at":"2013-09-24T09:25:56.000Z","size":244,"stargazers_count":32,"open_issues_count":2,"forks_count":11,"subscribers_count":16,"default_branch":"master","last_synced_at":"2025-03-29T19:34:31.845Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/outbrain-inc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":"audit_login.c","citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2013-09-16T13:44:31.000Z","updated_at":"2024-11-11T18:24:44.000Z","dependencies_parsed_at":"2022-08-23T15:31:15.382Z","dependency_job_id":null,"html_url":"https://github.com/outbrain-inc/audit_login","commit_stats":null,"previous_names":["outbrain-inc/audit_login"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/outbrain-inc%2Faudit_login","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/outbrain-inc%2Faudit_login/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/outbrain-inc%2Faudit_login/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/outbrain-inc%2Faudit_login/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/outbrain-inc","download_url":"https://codeload.github.com/outbrain-inc/audit_login/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250337280,"owners_count":21414092,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-25T23:12:14.929Z","updated_at":"2025-04-22T22:41:33.987Z","avatar_url":"https://github.com/outbrain-inc.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"audit_login\n===========\n\n**audit_login** is a MySQL plugin developed at [Outbrain](https://github.com/outbrain) which audits successful/failed logins to the server.\n\nWhen loaded, the plugin generates a log file named **audit_login.log** under the data directory (```@@datadir```). The following is a sample output:\n\n```JavaScript\n{\"ts\":\"2013-09-11 09:11:47\",\"type\":\"successful_login\",\"myhost\":\"gromit03\",\"thread\":\"74153868\",\"user\":\"web_user\",\"priv_user\":\"web_user\",\"host\":\"web-87.localdomain\",\"ip\":\"10.0.0.87\"}\n{\"ts\":\"2013-09-11 09:11:55\",\"type\":\"failed_login\",\"myhost\":\"gromit03\",\"thread\":\"74153869\",\"user\":\"backup_user\",\"priv_user\":\"\",\"host\":\"web-32\",\"ip\":\"10.0.0.32\"}\n{\"ts\":\"2013-09-11 09:11:57\",\"type\":\"failed_login\",\"myhost\":\"gromit03\",\"thread\":\"74153870\",\"user\":\"backup_user\",\"priv_user\":\"\",\"host\":\"web-32\",\"ip\":\"10.0.0.32\"}\n{\"ts\":\"2013-09-11 09:12:48\",\"type\":\"successful_login\",\"myhost\":\"gromit03\",\"thread\":\"74153871\",\"user\":\"root\",\"priv_user\":\"root\",\"host\":\"localhost\",\"ip\":\"(null)\"}\n{\"ts\":\"2013-09-11 09:13:26\",\"type\":\"successful_login\",\"myhost\":\"gromit03\",\"thread\":\"74153872\",\"user\":\"web_user\",\"priv_user\":\"web_user\",\"host\":\"web-11.localdomain\",\"ip\":\"10.0.0.11\"}\n{\"ts\":\"2013-09-11 09:13:44\",\"type\":\"successful_login\",\"myhost\":\"gromit03\",\"thread\":\"74153873\",\"user\":\"web_user\",\"priv_user\":\"web_user\",\"host\":\"web-40.localdomain\",\"ip\":\"10.0.0.40\"}\n{\"ts\":\"2013-09-11 09:13:51\",\"type\":\"successful_login\",\"myhost\":\"gromit03\",\"thread\":\"74153874\",\"user\":\"web_user\",\"priv_user\":\"web_user\",\"host\":\"web-03.localdomain\",\"ip\":\"10.0.0.3\"}\n{\"ts\":\"2013-09-11 09:14:09\",\"type\":\"successful_login\",\"myhost\":\"gromit03\",\"thread\":\"74153875\",\"user\":\"web_user\",\"priv_user\":\"web_user\",\"host\":\"web-40.localdomain\",\"ip\":\"10.0.0.40\"}\n{\"ts\":\"2013-09-11 10:55:25\",\"type\":\"successful_login\",\"myhost\":\"gromit03\",\"thread\":\"74153876\",\"user\":\"web_user\",\"priv_user\":\"web_user\",\"host\":\"web-87.localdomain\",\"ip\":\"10.0.0.87\"}\n{\"ts\":\"2013-09-11 10:55:59\",\"type\":\"successful_login\",\"myhost\":\"gromit03\",\"thread\":\"74153877\",\"user\":\"web_user\",\"priv_user\":\"web_user\",\"host\":\"web-12.localdomain\",\"ip\":\"10.0.0.12\"}\n{\"ts\":\"2013-09-11 10:55:59\",\"type\":\"successful_login\",\"myhost\":\"gromit03\",\"thread\":\"74153878\",\"user\":\"(null)\",\"priv_user\":\"(null)\",\"host\":\"(null)\",\"ip\":\"10.0.0.1\"}\n{\"ts\":\"2013-09-11 10:55:59\",\"type\":\"failed_login\",\"myhost\":\"gromit03\",\"thread\":\"74153878\",\"user\":\"(null)\",\"priv_user\":\"(null)\",\"host\":\"(null)\",\"ip\":\"10.0.0.1\"}\n```\n\nFields are:\n\n - **ts**: local timestamp on MySQL server\n - **type**: successful_login/failed_login\n - **myhost**: MySQL server being audited\n - **thread**: MySQL connection ID\n - **user**: username attempted as credential\n - **priv_user**: username assigned by MySQL if successful; empty otherwise\n - **host**: host from which connection originated\n - **ip**: IP from which connection originated\n\nEach row is a valid JSON object.\n\n\nInstallation\n------------\n\nAs an audit plugin for MySQL, it can be loaded/unloaded as follows:\n\n  - Dynamically:\n    ```\n    install plugin SIMPLE_LOGIN_AUDIT soname 'audit_login.so';\n    uninstall plugin SIMPLE_LOGIN_AUDIT;\n    ```\n\n  - Statically: in **my.cnf**, add\n    ```\n    plugin_load=audit_login.so\n    ```\n\nMySQL plugins are shared libraries; compiled against the particular version of the MySQL server. Find appropriate binaries under (TODO)\nPlugin source file is **audit_login.c**\n\n\n\n\nConfiguration\n-------------\n\nThe plugin supports two ways of configuration:\n\n  - via global variables: the plugin supports the ```simple_login_audit_enabled``` variable (boolean) which enables/disables logging to file. Use ```set global simple_login_audit_enabled := 0;``` for example, to disable the log (default: 1/enabled).\n  - via config file: the plugin reads the file **audit_login.cnf** (if exists) in the data directory. Sample file content:\n\n    ```\n    enabled=1\n    skip_users=collectd,nagios\n    ```\n\n    The file is read upon plugin initialization (system startup or ```INSTALL PLUGIN```).\n    - ```enabled``` takes the values **0**/**1**.\n    - ```skip_users``` instructs the plugin to avoid logging specific users. list must be comma delimited, no spaces allowed between tokens.\n\n\nCompiling plugin\n----------------\n\nExtract MySQL source distribution\n\n```\nbash$ cd \u003cpath-to-extracted-mysql-source\u003e\nbash$ mkdir -p plugin/audit_login/ \u0026\u0026 cp ~/git/audit_login/*.* plugin/audit_login/\nbash$ sh BUILD/autorun.sh\nbash$ ./configure\nbash$ make\n```\n\nfind result shared library as ```plugin/audit_login/audit_login.so```\n\nUse cases\n---------\n\nThe **audit_login.log** file is useful in:\n\n - Detecting failed logins (due to bad passwords)\n - Detecting port-scans (null users)\n - Finding accounts which are never used (users in mysql.user which do not appear on audit log)\n - Counting per-user logins\n - Counting successive failed logins per user\n\n\n\n\n\nReleased under the GPL (v2) license\n\nAuthored by Shlomi Noach, Outbrain\n\nCopyright (c) 2013, Outbrain Inc. All rights reserved\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foutbrain-inc%2Faudit_login","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Foutbrain-inc%2Faudit_login","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foutbrain-inc%2Faudit_login/lists"}