FortiSIEM MySQL Server Configuration

MySQL Server Configuration

What is Discovered and Monitored

Event Types

Rules

Reports

SNMP

JDBC for Database Auditing – MySQL Server

Settings for Access Credentials

Sample events

System Level Performance Metrics

Table Space Performance Metrics

System Level Performance Metrics

Logon/Logoff Events

Database CREATE/DELETE/MODIFY Events

Table CREATE/DELETE/MODIFY Events

What is Discovered and Monitored

Protocol Information discovered Metrics collected Used for
SNMP Application type Process level CPU and memory utilization Performance

Monitoring

WMI Application type, service mappings Process level metrics: uptime, CPU utilization, Memory utilization, Read I/O KBytes/sec, Write I/O KBytes/sec Performance

Monitoring

JDBC   Generic database information: Version, Character Setting  
JDBC   Database performance metrics:  User COnnections, Table Updates, table Selects, Table Inserts, Table Deletes,

Temp Table Creates, Slow Queries, Query cache Hits, Queries registered in cache, Database Questions, Users,

Live Threads

Table space performance metrics: Table space name, table space type, Character set and Collation, table space usage, table space free space, Database engine, Table version, Table Row Format, Table Row Count, Average Row Length, Index File length, Table Create time, Table Update Time

Performance

Monitoring

JDBC None Database audit trail: Successful and failed database log on, Database CREATE/DELETE/MODIFY operations, Table CREATE/DELETE/MODIFY/INSERT operations Security

Monitoring

Event Types

In CMDB > Event Types, search for “mysql” in the Device Type and Description columns to see the event types associated with this device.

Rules

In Analytics > Rules, search for “mysql” in the Name column to see the rules associated with this application or device.

Reports

In Analytics > Reports, search for “”mysql” in the Name and Description columns to see the reports associated with this application or device. Configuration

SNMP

AccelOps uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation, then follow the instructions in Setting Access Credentials for Device Discovery to establish the connection between the device and AccelOps, and to initiate the device discovery process.

JDBC for Database Auditing – MySQL Server

You need to configure your MySQL Server to write audit logs to a database table. This topic in the MySQL documentation explains more about how to set the destination tables for log outputs.

  1. Start MySQL server with TABLE output enabled.
  2. Login to mysql, run the following SQL commands to enable general.log in MyISAM.

You can now configure AccelOps to communicate with your device by following the instructions in Setting Access Credentials for Device Discovery, and then initiate discovery of the device as described in the topics in Discovering Infrastructure. Settings for Access Credentials

System Level Performance Metrics

Table Space Performance Metrics

<134>Apr 29 10:06:07 172.16.22.227 java: [PH_DEV_MON_PERF_MYSQLDB_TABLESPACE]: [eventSeverity]=PHL_INFO,

[appGroupName]=MySQL Database Server,

[instanceName]=mysql, [tablespaceName]=general_log, [tablespaceType]=PERMANENT, [tablespaceUsage]=0.01,

[tablespaceFreeSpace]=4193886,

[dbEngine]=MyISAM, [tableVersion]=10, [tableRowFormat]=dynamic,

[tableRows]=124, [tableAvgRowLength]=80, [tableIndexLength]=1024,

[tableCreateTime]=2013-04-29 15:12:30, [tableUpdateTime]=2013-04-29

12:35:46, [tableCollation]=utf8_general_ci

System Level Performance Metrics

Logon/Logoff Events

<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_ Logon_Success]:

[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,

[rptIp]=172.16.22.227,

[srcIp]=172.16.22.227, [user]=admin, [logonTime]=2013-04-29 15:14:54,

[logoffTime]=, [actionName]=Connect, [msg]=admin@172.16.22.227 on

<134>Apr 10 14:29:22 abc-desktop java:

[MYSQL_Logoff]:[eventSeverity]=PHL_INFO, [eventTime]=2013-04-10

14:29:22, [rptIp]=172.16.22.227,

[srcIp]=172.16.22.227, [user]=admin, [logonTime]=,

[logoffTime]=2014-04-10 14:29:22, [actionName]=quit, [msg]=

<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_ Logon_Fail]:

[eventSeverity]=PHL_WARN, [eventTime]=2013-04-29 15:14:54,

[rptIp]=172.16.22.227,

[srcIp]=172.16.22.227, [user]=admin, [logonTime]=2013-04-29 15:14:54,

[logoffTime]=, [actionName]=Connect, [msg]=Access denied for user ‘admin’@’172.16.22.227’ (using password:

YES)

Database CREATE/DELETE/MODIFY Events

Table CREATE/DELETE/MODIFY Events

<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Create_table]:

[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,

[rptIp]=172.16.22.227,

[srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=CREATE TABLE tutorials_tbl(     tutorial_id INT NOT NULL AUTO_INCREMENT, tutorial_title VARCHAR(100) NOT NULL,     tutorial_author VARCHAR(40) NOT NULL,     submission_date DATE,     PRIMARY KEY ( tutorial_id )    )

<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Delete_table]:

[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,

[rptIp]=172.16.22.227,

[srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=DELETE FROM tutorials_tbl WHERE tutorial_id=2NOT NULL,

tutorial_author VARCHAR(40) NOT NULL,     submission_date DATE,    PRIMARY KEY ( tutorial_id )

<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Insert_table]: [eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,

[rptIp]=172.16.22.227,

[srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=INSERT INTO tutorials_tbl       (tutorial_title, tutorial_author, submission_date)      VALUES      (“Learn Java”, “John Smith”, NOW())

<134>Apr 29 15:14:54 abc-desktop java: [MYSQL_Drop_table]:

[eventSeverity]=PHL_INFO, [eventTime]=2013-04-29 15:14:54,

[rptIp]=172.16.22.227, [srcIp]=172.16.22.227, [user]=admin, [actionName]=Query, [msg]=DROP table sliutable

This entry was posted in Administration Guides, FortiSIEM on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.