Description:

This Azure check ensures that the MySQL server parameter audit_log_enabled is set to ON, enabling database auditing on Azure Database for MySQL servers. Enabling auditing allows the database to record security-relevant events, including authentication activity and other audit events configured through related audit parameters.


Rationale:

If database auditing is disabled, critical security events such as login attempts and access activity are not recorded, limiting visibility into potential security incidents. Enabling audit_log_enabled ensures that audit logging is active, supports security monitoring and forensic investigations, and helps meet compliance and regulatory requirements.


Impact:

Enabling audit logging improves security visibility with minimal performance impact, particularly when limited to essential audit events. The change does not interrupt database availability, although a server restart may be required for the configuration to take effect depending on the server state.


Default Value:

By default, the audit_log_enabled parameter may be set to OFF, meaning database audit logging is disabled unless explicitly configured. This default configuration does not meet security best practices and requires manual enablement.


Test Plan:

  1. Sign in to the Azure Portal.

  2. Navigate to Azure Database for MySQL – Flexible Server.

  3. Select the target MySQL server.

  4. Open Server parameters.

  5. Locate the audit_log_enabled parameter.

  6. Verify that the value is set to ON or OFF.


  1. If the value is OFF, follow the implementation plan.


Implementation Plan:

  1. Log in to the Azure Portal.

  2. Navigate to the Azure Database for MySQL server and select the Database

  3. Under settings selection, select Server parameters.



  1. Search for the audit_log_enabled parameter and change the value from OFF to ON.

  1. Save the changes

Backout Plan:

  1. Log in to the Azure Portal.

  2. Navigate to the Azure Database for MySQL server and select the Database

  3. Under settings selection, select Server parameters.

  4. Search for the audit_log_enabled parameter and set the value to  OFF if rollback is required.

  5. Save the changes and restart the server if prompted.