主页：https://github.com/mcafee/mysql-audit/wiki
各版本安装包：https://bintray.com/mcafee/mysql-audit-plugin/release
安装步骤还是比较简单的，只有几步：
1）查看插件目录
mysql> SHOW GLOBAL VARIABLES LIKE 'plugin_dir'; +---------------+--------------------+ | Variable_name | Value | +---------------+--------------------+ | plugin_dir | /mysql/lib/plugin/ | +---------------+--------------------+ 1 row in set (0.00 sec)
2）复制下载的so文件至plugin_dir
3）安装插件，不报错即为成功
mysql> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';
4）可以查看安装的版本
mysql> SHOW GLOBAL STATUS LIKE 'AUDIT_version';
5）开启审计
mysql> SET GLOBAL audit_json_file=ON;
问题是，在第三步安装插件时总是不成功，报错
mysql> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so'; ERROR 1123 (HY000): Can't initialize function 'AUDIT'; Plugin initialization function failed.
查看错误日志，注意到offsets_by_version: 1，即为打开Offsets检验，但提示Offsets检验失败
140917 18:04:02 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 1 140917 18:04:03 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774) 140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21 (4a03ad064ed393dabdde175f3ea05ff2) match thread validation check fails with value: 0. Skipping offest. 140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21 (4a03ad064ed393dabdde175f3ea05ff2) match thread validation check fails with value: 0. Skipping offest. 140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21-55 (e4f1b39e9dca4edc51b8eb6aa09e2fa4) match thread validation check fails with value: 0. Skipping offest. 140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21-55 (e4f1b39e9dca4edc51b8eb6aa09e2fa4) match thread validation check fails with value: 0. Skipping offest. 140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21 (66d23cb577e2bcfe29da08833f5e7d8b) match thread validation check fails with value: 0. Skipping offest. 140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21 (66d23cb577e2bcfe29da08833f5e7d8b) match thread validation check fails with value: 0. Skipping offest. 140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21-rel25.0 (346a87d97dbf5d7aad3a9f7f707f9477) match thread validation check fails with value: 0. Skipping offest. 140917 18:04:03 [ERROR] Audit Plugin: Offsets: 5.5.21-rel25.0 (346a87d97dbf5d7aad3a9f7f707f9477) match thread validation check fails with value: 0. Skipping offest. 140917 18:04:03 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.21-log 140917 18:04:03 [ERROR] Plugin 'AUDIT' init function returned error. 140917 18:04:03 [Note] Audit Plugin: deinit
关闭audit_offsets_by_version后再试试，将audit_offsets_by_version=OFF写入/etc/my.cnf，重启数据库，再安装插件，仍然报错
140917 18:11:02 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 0 140917 18:11:02 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774) 140917 18:11:02 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.21-log 140917 18:11:02 [ERROR] Plugin 'AUDIT' init function returned error. 140917 18:11:02 [Note] Audit Plugin: deinit 140917 18:11:42 [Note] Start binlog_dump to slave_server(1204), pos(mysql-bin.000011, 107) 140917 18:11:48 [Note] Audit Plugin: Set interface version to: 12933376 (50521) 140917 18:11:48 [Note] Audit Plugin: starting up. Version: 1.0.5 , Revision: 479 (64bit). AUDIT plugin interface version: 50521 (0xc559). MySQL Server versi on: 5.5.21-log. 140917 18:11:48 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 0 140917 18:11:48 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774) 140917 18:11:48 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.21-log 140917 18:11:48 [ERROR] Plugin 'AUDIT' init function returned error. 140917 18:11:48 [Note] Audit Plugin: deinit
都是跟offsets有关，那就按照https://github.com/mcafee/mysql-audit/wiki/Troubleshooting
所写，获取本机上mysql版本对应的offsets后，写入my.cnf试试
下载offset计算脚本 https://raw.github.com/mcafee/mysql-audit/master/offset-extract/offset-extract.sh
由于我的是percona server，另外需要指明mysqld.debug路径来计算，可能还需要mysqld-debug.debug
# ./offset-extract.sh /mysql/bin/mysqld /usr/lib/debug/usr/sbin/mysqld.debug //offsets for: /mysql/bin/mysqld (5.5.21-log) {"5.5.21","325edbcbbfaabdddd7b22e3036c2d774", 6584, 6632, 4120, 4632, 104, 2608, 96, 0, 32, 104},
# ./offset-extract.sh /mysql/bin/mysqld /usr/lib/debug/usr/sbin/mysqld-debug.debug //offsets for: /mysql/bin/mysqld (5.5.21-log) {"5.5.21","325edbcbbfaabdddd7b22e3036c2d774", 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104},
加入my.cnf的插件参数：
plugin-load=AUDIT=libaudit_plugin.so
audit_json_file=1
audit_json_socket_name=/mysql/data/audit.sock
audit_json_socket=OFF
audit_json_file=ON
audit_json_log_file=/mysql/data/audit.log
audit_record_cmds=connect,update,delete
audit_validate_checksum=OFF
audit_offsets=6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104
mysqld.debug和mysqld-debug.debug的offsets我都加入my.cnf试了下，仍然报错，崩溃！
140917 15:38:26 [Note] Audit Plugin: starting up. Version: 1.0.5 , Revision: 479 (64bit). AUDIT plugin interface version: 50521 (0xc559). MySQL Server versi on: 5.5.21-log. 140917 15:38:26 [Note] Audit Plugin: setup_offsets audit_offsets: 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104 validate_checksum: 0 offsets_by_version: 1 140917 15:38:26 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774) 140917 15:38:26 [Note] Audit Plugin: setup_offsets Audit_formatter::thd_offsets values: 6608 6656 4136 4656 104 2608 96 0 32 104 140917 15:38:26 [ERROR] Audit Plugin: Offsets: (null) ((null)) match thread validation check fails with value: 0. Skipping offest. 140917 15:38:26 [ERROR] Audit Plugin: Offsets set didn't pass validation. audit_offsets: 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104 . 140917 15:38:26 [ERROR] Plugin 'AUDIT' init function returned error. 140917 15:38:26 [Note] Audit Plugin: deinit 140917 15:38:26 [Warning] 'proxies_priv' entry '@ root@zm03' ignored in --skip-name-resolve mode. 140917 15:38:26 [Note] Event Scheduler: Loaded 0 events 140917 15:38:26 [Note] /mysql/bin/mysqld: ready for connections. Version: '5.5.21-log' socket: '/mysql/mysqld.sock' port: 3306 Source distribution 140917 15:38:39 [Note] Audit Plugin: Set interface version to: 12933376 (50521) 140917 15:38:39 [Note] Audit Plugin: starting up. Version: 1.0.5 , Revision: 479 (64bit). AUDIT plugin interface version: 50521 (0xc559). MySQL Server versi on: 5.5.21-log. 140917 15:38:39 [Note] Audit Plugin: setup_offsets audit_offsets: 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104 validate_checksum: 0 offsets_by_version: 1 140917 15:38:39 [Note] Audit Plugin: mysqld: /mysql/bin/mysqld (325edbcbbfaabdddd7b22e3036c2d774) 140917 15:38:39 [Note] Audit Plugin: setup_offsets Audit_formatter::thd_offsets values: 6608 6656 4136 4656 104 2608 96 0 32 104 140917 15:38:39 [ERROR] Audit Plugin: Offsets: (null) ((null)) match thread validation check fails with value: 0. Skipping offest. 140917 15:38:39 [ERROR] Audit Plugin: Offsets set didn't pass validation. audit_offsets: 6608, 6656, 4136, 4656, 104, 2608, 96, 0, 32, 104 . 140917 15:38:39 [ERROR] Plugin 'AUDIT' init function returned error. 140917 15:38:39 [Note] Audit Plugin: deinit
问题出在哪儿呢，该怎么配置呢？这里先记一笔！