Configure and access audit logs in the Azure CLI

APPLIES TO: Azure Database for MySQL - Single Server

Important

Azure Database for MySQL single server is on the retirement path. We strongly recommend that you upgrade to Azure Database for MySQL flexible server. For more information about migrating to Azure Database for MySQL flexible server, see What's happening to Azure Database for MySQL Single Server?

You can configure the Azure Database for MySQL audit logs from the Azure CLI.

Prerequisites

To step through this how-to guide:

• You need an Azure Database for MySQL server.

• Use the Bash environment in Azure Cloud Shell. For more information, see Quickstart for Bash in Azure Cloud Shell.

  

• If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.

  • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.

  • When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.

  • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

• This article requires version 2.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.

Configure audit logging

Important

It is recommended to only log the event types and users required for your auditing purposes to ensure your server's performance is not heavily impacted.

Enable and configure audit logging using the following steps:

1. Turn on audit logs by setting the audit_logs_enabled parameter to "ON".

   az mysql server configuration set --name audit_log_enabled --resource-group myresourcegroup --server mydemoserver --value ON
   

2. Select the event types to be logged by updating the audit_log_events parameter.

   az mysql server configuration set --name audit_log_events --resource-group myresourcegroup --server mydemoserver --value "ADMIN,CONNECTION"
   

3. Add any MySQL users to be excluded from logging by updating the audit_log_exclude_users parameter. Specify users by providing their MySQL user name.

   az mysql server configuration set --name audit_log_exclude_users --resource-group myresourcegroup --server mydemoserver --value "azure_superuser"
   

4. Add any specific MySQL users to be included for logging by updating the audit_log_include_users parameter. Specify users by providing their MySQL user name.

   az mysql server configuration set --name audit_log_include_users --resource-group myresourcegroup --server mydemoserver --value "sampleuser"
   

Next steps

• Learn more about audit logs in Azure Database for MySQL
• Learn how to configure audit logs in the Azure portal