Description:

The audit_log_events parameter controls which types of database events are logged by the MySQL audit plugin. Setting CONNECTION ensures that all connection-related events (such as login and logout) are recorded in the audit logs, which is critical for tracking access to the database server.


Rationale:

Enabling CONNECTION logging allows administrators to monitor who is connecting to the MySQL server, detect unauthorized access attempts, and maintain compliance with security policies and regulations (e.g., PCI-DSS, HIPAA). Without connection auditing, malicious or anomalous login activity might go unnoticed.


Impact:

  • Positive: Improved visibility into database access events; enhanced security and compliance.

  • Performance: Minimal performance overhead from logging connection events.

  • Operational: Requires periodic review of audit logs to detect suspicious activities.


Default Value:

In Azure Database for MySQL – Flexible Server, the audit_log_events parameter is set to CONNECTION by default. Therefore, this check is compliant by default unless the parameter value is explicitly modified.


Pre-Requisites:

  • An Azure Database for MySQL Flexible Server must be deployed and accessible in the Azure Portal.

  • The user performing the check or configuration must have sufficient permissions, such as Owner, Contributor, or a role with access to modify server parameters. 


Test Plan:

  1. Log in to the Azure Portal.

  2. Search for Azure Database for MySQL flexible serversand select the Database

  3. Under settings selection, select Server parameters.

  4. Search for the require_secure_transport parameter and verify its value is ON or OFF.


  1. If the value is not connection, follow the implementation plan.


Implementation Plan:

  1. Log in to the Azure Portal.

  2. Navigate to the Azure Database for MySQL server and select the Database

  3. Under settings selection, select Server parameters.



  1. Search for the audit_log_events parameter and change the value to Connection.

  1. Save the changes.


BackOut Plan:

  1. Log in to the Azure Portal.

  2. Navigate to the Azure Database for MySQL server and select the Database

  3. Under settings selection, select Server parameters.

  4. Search for the audit_log_events parameter and change the value to the previous value. 

  5. Save the changes.


Reference:

Audit log configuration for Azure MySQL Database