Accenture MDR Quick Start Guide for MariaDB Server

This quick start guide will help Accenture MDR customers configure MariaDB Event Collector to send logs to the Log Collection Platform (LCP).

 The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring MariaDB Event Collector

The below steps are validated on following Linux distribution - Ubuntu 24.04.1 LTS.

Pre-requisites

• Ensure MariaDB Server is installed and running in the machine.

• Ensure that mariadb server_audit plugin library must be located in the mariadb plugin directory. This library can be found named as the server_audit.so or server_audit.dll as shared library in MariaDB packages directory with default installation.
  
  

Install and Configure MariaDB Server Audit Plugin

1. Login into CLI with root or similar privileges.

2. Add following configuration in the various config blocks of mariadb configuration file /etc/mysql/mariadb.conf.d/50-server.cnf to enable logging using Server Audit Plugin.

   1. Under [server] block add following lines:

      [server] plugin_load_add = server_audit server_audit_logging=ON

       

   2. Under [mysqld] block add following lines -

      [mysqld] server_audit_events=connect,query,table server_audit_output_type=file

       

      Open

      

   3. Optional Step - If customer wishes to implement log file rotation then it can be done by adding following lines under [mysqld] block.
      
      

      server_audit_file_rotate_now=ON server_audit_file_rotate_size=1000000 server_audit_file_rotations=5

       

      Open

      

       

3. Restart mariadb service.

NxLog Configuration

1. Download and install the NXLog Linux agent from the following location: Download - Nxlog Community Edition

2. Stop the NxLog service.

3. Rename the attached file to "nxlog.conf" and copy into "/etc/" folder.

4. If MariaDB is configured with custom audit log path, update the File directive on line 25 with the correct audit log file path. By default, it is set to /var/lib/mysql/server_audit.log in the provided NXLog configuration.

5. Replace the placeholder <CyberHub IP> with the actual CyberHub IP in the nxlog.conf file.

6. Copy the certificate which you obtained from MxDR team on Linux machine where nxlog agent is installed and mention the cert path in “nxlog.conf” against "CAFile" on line number 34.

7. Now, start the NxLog service.

8. NxLog agent logs will be available at location "/var/log/nxlog.log".

9. The log flow should work, and you can check it using tcpdump with the command "tcpdump -AA port 10014".
   
   

LCP Configuration Parameters

Table 1-2: The MariaDB event collector (Generic- 4039) properties to be configured by MDR are shown in the table.