MariaDB must generate audit records when successful logons or connections occur.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-253764	SRG-APP-000503-DB-000350	MADB-10-011200	SV-253764r961824_rule	2024-12-05	2

Description
For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to the DBMS.

ℹ️ Check
Check what filters are in place by running the following as an administrative user: MariaDB> SELECT * FROM mysql.server_audit_filters; Verify connect_events include connect in audit filters. If not, this is a finding. Log in to and out of the MariaDB database server. Verify the connect is logged in the audit logfile or syslog depending on how it is configured. If connect is not logged this is a finding.

ℹ️ Check

Check what filters are in place by running the following as an administrative user: MariaDB> SELECT * FROM mysql.server_audit_filters; Verify connect_events include connect in audit filters. If not, this is a finding. Log in to and out of the MariaDB database server. Verify the connect is logged in the audit logfile or syslog depending on how it is configured. If connect is not logged this is a finding.

✔️ Fix
Edit the necessary filters to include connect_events connect. Example: MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default'; MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule) VALUES ('default', JSON_COMPACT( '{ "connect_event": [ "CONNECT", "DISCONNECT" ] }' ));