MySQLMonitor

[nycct3]

Having difficulty with a class project. We have a Splunk server put up on a windows server 2008 machine. Looking to pull data from a remote MySQL database on the same network. We wanted to know where the configuration file was to use the MySQLMonitor and record the reads and writes of the database.

[bonito]

Hi,

The MySQL monitor app has no ability to log reads and writes to the database in any detail, although it can count the number of select/insert/update/delete queries. The MySQL monitor app has a welcome screen that gives the basic instructions on how to configure it, which will include this functionality.

The two ways I can think of to do anything more complicated -- such as auditing every query:

1. Enable the general query log, which logs all activity to the database (and can slow it down, as well as use a lot of space). There's no existing Splunk config for this that I know of.
2. Use the MySQL proxy to intercept queries and log them to Splunk. This should be faster and you can do more fancy things such as only log one in every 10 queries -- which may be enough if you are just looking for more statistical information.

I've put an example MySQL proxy script that can send data to Splunk here: http://pastebin.com/7QUjMhPb. It's definitely incomplete -- it just logs to stdout rather than sending data to a TCP port like I originally intended. I don't know if it works any more -- this is from a couple of years back that never made it into production and I can't really provide any support as I no longer have any idea how it all fits together.