MySql怎样追踪用户操作(增删改)记录
有时，我们想追踪某个数据库操作记录，如想找出是谁操作了某个表（比如谁将字段名改了）。
二进制日志记录了操作记录，线程号等信息，但是却没有记录用户信息，因此需要结合init-connect来实现追踪。
init-connect，在每次连接的初始化阶段，记录下这个连接的用户，和connection_id信息。
实验步骤：
1:建监控连接信息的表
use dba;
create table accesslog(`thread_id` int primary key auto_increment, `time` timestamp, `localname` varchar(40), `machine_name` varchar(40));
2：设置变量init_connect
mysql> show variables like 'init%';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| init_connect | |
| init_file | |
| init_slave | |
+---------------+-------+
3 rows in set (0.00 sec)
mysql> set global init_connect='insert into dba.accesslog(thread_id,time,localname,machine_name) values(connection_id(),now(),user(),current_user());';
Query OK, 0 rows affected (0.00 sec)
mysql> show variables like 'init%';
+---------------+-----------------------------------------------------------------------------------------------------------------------+
| Variable_name | Value |
+---------------+-----------------------------------------------------------------------------------------------------------------------+
| init_connect | insert into dba.accesslog(thread_id,time,localname,machine_name) values(connection_id(),now(),user(),current_user()); |
| init_file | |
| init_slave | |
+---------------+-----------------------------------------------------------------------------------------------------------------------+
3 rows in set (0.00 sec)
3：分配用户权限
mysql> grant select,insert,update on dba.accesslog to baidandan@'192.168.9.45' identified by 'baidandan';
Query OK, 0 rows affected (0.00 sec)
--为了做实验，给baidandan赋予操作dba.t表的权限
mysql> grant select,delete on dba.t to baidandan@'192.168.9.45';
Query OK, 0 rows affected (0.00 sec)
4：测试
--客户端连接进行测试
C:\Users\dandan>mysql -u baidandan -p -h 192.168.6.51
Enter password: *********
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 371
Server version: 5.6.20-r5436-log Source distribution
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> use dba;
Database changed
mysql> delete from t;
Query OK, 1 row affected (0.10 sec)
mysql> commit;
Query OK, 0 rows affected (0.00 sec)
mysql> select * from t;
Empty set (0.00 sec)
假如我现在想看是谁把DBA.t表里的数据给删掉了。
查看日志：
mysql> show master status;
+------------------+----------+--------------+------------------+-------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB | Executed_Gtid_Set |
+------------------+----------+--------------+------------------+-------------------+
| mysql-bin.000007 | 1640 | | | |
+------------------+----------+--------------+------------------+-------------------+
1 row in set (0.00 sec)
--假如我知道这个数据是在6月18号9点后被删除的：
[root@ser6-51 data]# mysqlbinlog mysql-bin.000007 --start-datetime='2015-06-18 09:00:00'
--查到删除的语句：
#150618 16:55:30 server id 1 end_log_pos 1609 CRC32 0xa2296c53 Query thread_id=371 exec_time=0 error_code=0
use `dba`/*!*/;
SET TIMESTAMP=1434617730/*!*/;
delete from t
/*!*/;
--查询accesslog表
mysql> select * from dba.accesslog where thread_id=371;
+-----------+---------------------+------------------------+------------------------+
| thread_id | time | localname | machine_name |
+-----------+---------------------+------------------------+------------------------+
| 371 | 2015-06-18 16:55:19 | [email protected] | [email protected] |
+-----------+---------------------+------------------------+------------------------+
1 row in set (0.00 sec)
注意： 对于所有的普通级别的用户，必须全部都要对日志表具有读写权限， 否则将导致，没有权限的用户无法使用数据库。
init_connect 不会记录有超级管理员权限的用户连接信息 (原因:当init_connect设置有误时,超级管理员可进行修改)
因此，对于一般的用户，不能赋予all privileges权限。
--如果想查看所有的增删改查记录，在general log（需要先开启）里查询即可。里面记录了连接的用户和IP信息。如：
2016-10-08T12:09:58.476859Z 57 Connect [email protected] on dba using TCP/IP
--本篇文章参考自：http://blog.csdn.net/ljasdf123/article/details/14166793