MariaDB Audit Plugin File Log

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/database-mariadb-audit/generator.yml \
  --id database-mariadb-audit \
  --live-mode true

Event Types

Realism Features

• Volume follows a UTC hour-of-day curve: 0.28 records/s at 08-19, 0.18 at 07-08 and 19-21 and 0.10 at 21-07, about 16,700 records a day with ±3% day-to-day variation. The curve repeats every day, so weekends look like weekdays. Rates are chosen assumptions, not vendor-measured frequencies.
• Three long-lived connections of the application account write about 96% of the records: point SELECT (65%), UPDATE (25%) and INSERT (10%) against 50 orders tables, a median of 51 statements per connection, each connection replaced after a median 30 minutes. DBAs and delegates work mostly in business hours, about 4.7 sessions an hour at 08-18 UTC and 0.1 at night, a median of 2 statements 25 s apart; up to seven sessions are open at once.
• About 11 temporary grants a day, mostly in business hours: a DBA grants a delegate SELECT on one sensitive table, the delegate reads it one to five times, the DBA revokes the grant, and a median 200 s later the delegate's next attempt is denied with 1142. GRANTs of one DBA are at least 30 minutes apart, and up to two temporary grants exist at once.
• Failed logins are about 4% of login attempts, about 9 a day: mistyped passwords retried after a median 8 s, give-ups, and stale-password bursts of 2 to 5 failures within seconds. Runs of three or more failures followed by a login occur two to three times a week for the two DBAs together; about twice a week such a run reaches a DBA's grant maintenance, and that DBA then works on the sensitive tables without a GRANT.
• Record semantics follow the tagged 11.4.4 source: table lock records precede their QUERY with the same query ID and second and an empty retcode (a lock was taken, not rows returned), 1142 denials and 1064 syntax errors take no lock, a failed login closes in the same second with an empty database, and the COM_QUIT that ends a session consumes a query ID. event.created is the collection time: the same second in half of the records, within 8 s for 90%, up to about two minutes at night.
• With anomaly_mode true, each episode adds three or four failed logins of one DBA and one GRANT, REVOKE and 1142 denial: at the default interval the DBAs' failed logins are about 1.7 times the background level (about 8.5 instead of 5 a day), and runs of three or more failures followed by a login occur about 9-10 times a week instead of two or three.
• No unmodified production audit file was available: the field grammar comes from the tagged source and its regression result, the GRANT/REVOKE system-table records are derived from source rather than a captured trace, and ID values, timing and workload are synthetic. FILE output only; neither the SYSLOG output of this version nor the client ports and TLS details added in 12.x are modelled. Clients send no connect-time statements, connection ids increase by one per connection, and there is one application server.
• ECS fields beyond the parsed native slots are collector-side enrichment. No maintained Elastic integration covers server_audit and no SIEM parser was run. The records do not show why logins failed, which rows were returned, or data exfiltration.

Sample Output

{
  "@timestamp": "2026-10-12T10:26:30+00:00",
  "ecs": {
    "version": "8.17.0"
  },
  "event": {
    "action": "query",
    "category": [
      "database",
      "iam"
    ],
    "created": "2026-10-12T10:26:35.421863+00:00",
    "dataset": "mariadb.audit",
    "ingested": "2026-10-12T10:26:35.421863+00:00",
    "kind": "event",
    "original": "20261012 10:26:30,db-01.corp.example,dba_ops,10.99.4.52,1081,4771,QUERY,payroll,'GRANT SELECT ON payroll.bonuses TO \\'report_user\\'@\\'10.99.5.22\\'',0",
    "outcome": "success",
    "type": [
      "change"
    ]
  },
  "host": {
    "ip": [
      "10.100.0.5"
    ],
    "name": "db-01.corp.example"
  },
  "log": {
    "file": {
      "path": "/var/log/mariadb/server_audit.log"
    }
  },
  "mariadb": {
    "audit": {
      "connectionid": 1081,
      "database": "payroll",
      "host": "10.99.4.52",
      "object": "GRANT SELECT ON payroll.bonuses TO 'report_user'@'10.99.5.22'",
      "operation": "QUERY",
      "queryid": 4771,
      "retcode": 0,
      "serverhost": "db-01.corp.example",
      "timestamp": "20261012 10:26:30",
      "username": "dba_ops"
    }
  },
  "message": "20261012 10:26:30,db-01.corp.example,dba_ops,10.99.4.52,1081,4771,QUERY,payroll,'GRANT SELECT ON payroll.bonuses TO \\'report_user\\'@\\'10.99.5.22\\'',0",
  "observer": {
    "hostname": "db-01.corp.example",
    "ip": [
      "10.100.0.5"
    ],
    "product": "MariaDB Community Server",
    "type": "database",
    "vendor": "MariaDB",
    "version": "11.4.4"
  },
  "related": {
    "ip": [
      "10.99.4.52"
    ],
    "user": [
      "dba_ops"
    ]
  },
  "service": {
    "type": "mariadb",
    "version": "11.4.4"
  },
  "source": {
    "ip": "10.99.4.52"
  },
  "tags": [
    "mariadb-audit",
    "preserve_original_event"
  ],
  "user": {
    "name": "dba_ops"
  }
}

Parameters