MariaDB Server

About the Device

MariaDB is a free, open-source relational database management system (RDBMS). It's a modified version of MySQL, and was created by the original developers of MySQL. Supports the following features, Open source, High performance, Scalable, supports multiple programming languages and supports major operating systems.

Device Information

Collection Method

Port Requirements

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 10014 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

The below steps are validated on Linux distribution - Ubuntu 24.04.1 LTS.

Prerequisites:

• Ensure MariaDB Server is installed and running in the machine.

• Ensure that MariaDB server_audit plugin library must be located in the MariaDB plugin directory. This library can be found named as the server_audit.so or server_audit.dll as shared library in MariaDB packages directory with default installation.

To Install and Configure MariaDB Server Audit Plugin

1. Login into CLI with root or similar privileges.

2. Add the following configuration in the config blocks of MariaDB configuration file /etc/mysql/mariadb.conf.d/50-server.cnf to enable logging using Server Audit Plugin.

   1. In [server] block add the following:

      [server] plugin_load_add = server_audit server_audit_logging=ON

       

   2. In [mysqld] block add the following:

      [mysqld] server_audit_events=connect,query,table server_audit_output_type=file

       

      Open

      

   3. Optional Step - If customer wishes to implement log file rotation then it can be done by adding the following in [mysqld] block.

      server_audit_file_rotate_now=ON server_audit_file_rotate_size=1000000 server_audit_file_rotations=5

       

      Open

      

       

3. Restart mariadb service.

    

NxLog Configuration

1. Download and install the NXLog Linux agent from the following location: https://nxlog.co/downloads/nxlog-ce#nxlog-community-edition

2. Stop the NxLog service.

3. Rename the attached file to nxlog.conf and copy into /etc/ folder.

4. If MariaDB is configured with custom audit log path, update the File directive on line 25 with the correct audit log file path. By default, it is set to /var/lib/mysql/server_audit.log in the provided NXLog configuration.

5. Replace the placeholder <CyberHub IP> with the actual CyberHub IP in the nxlog.conf file.

6. Copy the certificate which you obtained from MxDR team on Linux machine where nxlog agent is installed and mention the cert path in nxlog.conf against "CAFile" on line number 34.

7. Now, start the NxLog service.

8. NxLog agent logs will be available at location /var/log/nxlog.log

9. The log flow should work, and you can check it using tcpdump with the command "tcpdump -AA port 10014".

Integration Parameters

Parameters required from customer for Integration.