TMA-TDSQL-6.9

Ensure Audit Logs Are Written in Append Mode and Protected from Overwrite

MoyenneNiveau 1Automatiséetdsql

Description

audit_txsql_rotate_write_log controls how the TXSQL audit facility handles local audit files. The value is intentionally counterintuitive: OFF uses append mode with date- and size-based file creation, while ON uses circular files that may overwrite earlier evidence. Runs the mysql client against the TDSQL data node selected by TDSQL_MYSQL_OPTS (e.g. "-h10.0.0.5 -P4001 -utdsql_audit"); keep the password in ~/.my.cnf or a login path rather than MYSQL_PWD or the command line (see 1.4 and 1.5). The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Run against every primary and replica. Passes when audit_txsql_rotate_write_log is OFF (append mode); also confirm audit files use append-mode names (audit_log.YYYY-MM-DD.ID) and reach the central destination before local cleanup.

Méthode de vérification

Méthode d'audit: Requête SQL

sql_query

out=$(mysql ${TDSQL_MYSQL_OPTS:-} -NBe "SHOW GLOBAL VARIABLES LIKE 'audit_txsql_rotate_write_log'" 2>/dev/null) || exit 1; v=$(printf '%s\n' "$out" | awk -F'\t' '$1 == "audit_txsql_rotate_write_log" {print toupper($2)}'); case "$v" in OFF|0) echo compliant;; *) echo "value '$v'";; esac

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

SET GLOBAL audit_txsql_rotate_write_log = OFF; persist it through the TDSQL parameter template and configure disk-capacity alerts for the audit directory.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: tdsqlloggingaudit
Référence: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 6.9 Ensure Audit Logs Are Written in Append Mode and Protected from Overwrite

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target tdsql