Skip to content

Commit

Permalink
PS-9517 [DOCS] - Update restrict dynamic log locations 8.4
Browse files Browse the repository at this point in the history
	modified:   docs/restrict-dynamic-log-locations.md
  • Loading branch information
patrickbirch committed Dec 20, 2024
1 parent 0e90954 commit 79771ae
Showing 1 changed file with 28 additions and 2 deletions.
30 changes: 28 additions & 2 deletions docs/restrict-dynamic-log-locations.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,35 @@
# Restrict dynamic log file locations

The `secure_log_path` system variable restricts the dynamic log file locations.
The `secure_log_path` system variable plays a crucial role in enhancing the security and organization of log files within a MySQL database environment by restricting where dynamic log files can be stored.

In a MySQL environment, restricting dynamic log locations offers several benefits:

| Benefit | Details |
|----------------------|--------------------------------------------------------------------------------------------------------------|
| Enhanced security | It prevents unauthorized modification of log files, protecting sensitive information and audit trails. |
| Improved compliance | It helps meet regulatory requirements for data security and auditability. |
| Simplified administration | It centralizes log files, making them easier to manage and monitor. |
| Increased reliability | It reduces the risk of accidental log file deletion or corruption. |

The disadvantages could be:

* Reduced flexibility: Cannot change the log file locations easily

* Increased complexity: Adds an extra layer of configuration and management

* Performance impact: Writing to log files on slower storage media may increase overhead and potentially affect the overall performance of the MySQL server.

The benefits of restricting dynamic log locations in MySQL outweigh the disadvantages, especially in security-conscious environments.

## secure_log_path

The variable is read-only and must be set up in a configuration file or the command line.

The accepted value is the directory name as a string. The default value is an empty string. When the value is an empty string, the variable only adds a warning to the error log and does nothing. If the value contains a directory name, then the slow query log and the general log must be located in that directory. An attempt to move either of these files outside of the specified directory results in an error.
The expected value is the directory name provided as a string. The default value is an empty string.

| Value | Description |
|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Empty string | The variable only adds a warning to the error log and does nothing. |
| Directory name| If the value contains a directory name, then the slow query log and the general log must be located in that directory. An attempt to move either of these files outside of the specified directory results in an error. |

By establishing a controlled logging environment through the `secure_log_path` variable, MySQL administrators can significantly enhance both the security and manageability of their logs, reducing risks associated with unauthorized access and data integrity.

0 comments on commit 79771ae

Please sign in to comment.