环境：mysql5.7.19+centos 7

一，审计安装：
1、下载mariadb-5.5.56-linux-x86_64.tar.gz解压获取server_audit.so插件

2、登录MySQL，执行命令获取MySQL的plugin目录
mysql> SHOW GLOBAL VARIABLES LIKE 'plugin_dir';
+---------------+--------------------------+
| Variable_name | Value |
+---------------+--------------------------+
| plugin_dir | /usr/lib64/mysql/plugin/ |
+---------------+--------------------------+
1 row in set (0.02 sec)

3、将server_audit.so上传到 /usr/lib64/mysql/plugin/下
#mkdir -p /data/home/admin/mysql/auditlogs/

4、在命令下安装server_audit.so
mysql> INSTALL PLUGIN server_audit SONAME 'server_audit.so';

5、查看变量开启设置情况
mysql> show variables like '%audit%';
mysql> set  global server_audit_logging=on;

6、编辑my.cnf,添加配置
server_audit_logging=on
server_audit_file_path =/data/home/admin/mysql/auditlogs/
server_audit_file_rotate_size=200000000
server_audit_file_rotations=200
server_audit_file_rotate_now=ON

7、重启服务，service mysqld restart
mysql> show variables like '%audit%';
+-------------------------------+---------------------------------------------------+
| Variable_name | Value |
+-------------------------------+---------------------------------------------------+
| server_audit_events | CONNECT,QUERY,TABLE,QUERY_DDL,QUERY_DML,QUERY_DCL |
| server_audit_excl_users | |
| server_audit_file_path | /data/mysql/auditlogs/ |
| server_audit_file_rotate_now | ON |
| server_audit_file_rotate_size | 200000000 |
| server_audit_file_rotations | 200 |
| server_audit_incl_users | |
| server_audit_loc_info | |
| server_audit_logging | ON |
| server_audit_mode | 1 |
| server_audit_output_type | file |
| server_audit_query_log_limit | 1024 |
| server_audit_syslog_facility | LOG_USER |
| server_audit_syslog_ident | mysql-server_auditing |
| server_audit_syslog_info | |
| server_audit_syslog_priority | LOG_INFO |
+-------------------------------+---------------------------------------------------+

9、卸载server_audit
mysql> UNINSTALL PLUGIN server_audit;
mysql> show variables like '%audit%';
Empty set (0.00 sec)

防止server_audit 插件被卸载，需要在配置文件中添加:
[mysqld]
server_audit=FORCE_PLUS_PERMANENT
重启MySQL生效