TMA-TDSQL-6.9
Ensure Audit Logs Are Written in Append Mode and Protected from Overwrite
Deskripsi
audit_txsql_rotate_write_log controls how the TXSQL audit facility handles local audit files. The value is intentionally counterintuitive: OFF uses append mode with date- and size-based file creation, while ON uses circular files that may overwrite earlier evidence. Runs the mysql client against the TDSQL data node selected by TDSQL_MYSQL_OPTS (e.g. "-h10.0.0.5 -P4001 -utdsql_audit"); keep the password in ~/.my.cnf or a login path rather than MYSQL_PWD or the command line (see 1.4 and 1.5). The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Run against every primary and replica. Passes when audit_txsql_rotate_write_log is OFF (append mode); also confirm audit files use append-mode names (audit_log.YYYY-MM-DD.ID) and reach the central destination before local cleanup.
Cara pemeriksaan
Metode audit: Kueri SQL
out=$(mysql ${TDSQL_MYSQL_OPTS:-} -NBe "SHOW GLOBAL VARIABLES LIKE 'audit_txsql_rotate_write_log'" 2>/dev/null) || exit 1; v=$(printf '%s\n' "$out" | awk -F'\t' '$1 == "audit_txsql_rotate_write_log" {print toupper($2)}'); case "$v" in OFF|0) echo compliant;; *) echo "value '$v'";; esac- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
SET GLOBAL audit_txsql_rotate_write_log = OFF; persist it through the TDSQL parameter template and configure disk-capacity alerts for the audit directory.
Properti
- Sistem operasi
- Apa saja
- Tag
- tdsqlloggingaudit
- Referensi
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 6.9 Ensure Audit Logs Are Written in Append Mode and Protected from Overwrite
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target tdsql