ChamplainTechJournals/db-security-sec300/week4.md

Week4

Log analysis

• sudo nano /etc/mysql/mysql.conf.d/mysqld.cnf

• Display failed connect logs, display only date, time, and user

cat /var/log/mysql/query.log | awk -F"[[:space:]T]+" '/Access denied/ {print $1,$2,$9}'

• Display successful connect logs, display only date, time, and user

cat /var/log/mysql/query.log | awk -F"[[:space:]T]+" '/Connect/ {print $1,$2,$5}' | grep -v 'Access'