Configure and access audit logs in the Azure CLI

APPLIES TO: Azure Database for MySQL - Single Server

You can configure the Azure Database for MySQL audit logs from the Azure CLI.

Prerequisites

To step through this how-to guide:

  • Use the Bash environment in Azure Cloud Shell.

    Launch Cloud Shell in a new window

  • If you prefer, install the Azure CLI to run CLI reference commands.

    • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For additional sign-in options, see Sign in with the Azure CLI.

    • When you're prompted, install Azure CLI extensions on first use. For more information about extensions, see Use extensions with the Azure CLI.

    • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

  • This article requires version 2.0 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.

Configure audit logging

Important

It is recommended to only log the event types and users required for your auditing purposes to ensure your server's performance is not heavily impacted.

Enable and configure audit logging using the following steps:

  1. Turn on audit logs by setting the audit_logs_enabled parameter to "ON".

    az mysql server configuration set --name audit_log_enabled --resource-group myresourcegroup --server mydemoserver --value ON
    
  2. Select the event types to be logged by updating the audit_log_events parameter.

    az mysql server configuration set --name audit_log_events --resource-group myresourcegroup --server mydemoserver --value "ADMIN,CONNECTION"
    
  3. Add any MySQL users to be excluded from logging by updating the audit_log_exclude_users parameter. Specify users by providing their MySQL user name.

    az mysql server configuration set --name audit_log_exclude_users --resource-group myresourcegroup --server mydemoserver --value "azure_superuser"
    
  4. Add any specific MySQL users to be included for logging by updating the audit_log_include_users parameter. Specify users by providing their MySQL user name.

    az mysql server configuration set --name audit_log_include_users --resource-group myresourcegroup --server mydemoserver --value "sampleuser"
    

Next steps

  • Learn more about audit logs in Azure Database for MySQL
  • Learn how to configure audit logs in the Azure portal