# Audit log file permission

**URL:** <https://forums.percona.com/t/audit-log-file-permission/26234>\
**Category:** Percona XtraDB Cluster\
**Created:** [October 30, 2023, 8:40am UTC](https://forums.percona.com/t/audit-log-file-permission/26234 "2023-10-30T08:40:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bthnklc](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@bthnklc](https://forums.percona.com/u/bthnklc)\
**Post date:** [October 30, 2023, 8:40am UTC](https://forums.percona.com/t/audit-log-file-permission/26234/1 "2023-10-30T08:40:00Z")

</div>

Hi,

When the Audit log file is newly created, it is created with 640 rights. I have an authorization problem on the rsyslog side when the file is created with 640 rights. Here, I need a method to create the auditlog file with 644 or to enable rsyslog to read the file with existing rights. I would appreciate your help.

my.cnf:

audit\_log\_format=JSON  
audit\_log\_file=/data2/audit/audit.log  
audit\_log\_strategy=SYNCHRONOUS  
log\_timestamps=SYSTEM  
audit\_log\_rotate\_on\_size=250M  
audit\_log\_rotations=200

current audit file:

-rw-r----- 1 mysql mysql 148399808 Oct 30 11:41 audit.log

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [October 30, 2023, 2:44pm UTC](https://forums.percona.com/t/audit-log-file-permission/26234/2 "2023-10-30T14:44:00Z")

</div>

Hello @bthnklc,  
Since you are trying to stream logs, would these parameters help?

> <https://github.com/percona/percona-server/blob/8.0/doc/source/management/audit_log_plugin.rst#streaming-the-audit-log-to-syslog>

If not, you would need to open a feature request at [https://jira.percona.com/](https://jira.percona.com/) and our team will evaluate priority and see about making a fix.

---

<div class="post-metadata">

**Author:** ![bthnklc](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@bthnklc](https://forums.percona.com/u/bthnklc)\
**Post date:** [October 31, 2023, 7:42am UTC](https://forums.percona.com/t/audit-log-file-permission/26234/3 "2023-10-31T07:42:14Z")

</div>

> [@matthewb](#):
>
> ```auto
> Percona Audit Log Plugin provides monitoring and logging of connection and query
> activity that were performed on specific server. Information about the activity
> is stored in a log file. This
> implementation is alternative to the `MySQL Enterprise Audit Log Plugin
> <https://dev.mysql.com/doc/refman/8.0/en/audit-log.html>`_
> 
> Audit logging documents the database usage. You can use the log for troubleshooting. 
> 
> * **Audit** - Audit event indicates that audit logging started or finished. ``NAME`` field will be ``Audit`` when logging started and ``NoAudit`` when logging finished. Audit record also includes server version and command-line arguments.
> 
> ```

Another situation occurred in the problem. I deleted the audit plugin on the node where I had a problem on the database system, which I positioned as master-master in five nodes, and when I wanted to install it again, it appeared to be in deleted status on the other nodes. When I wanted to install it again, it gave an error and disconnected from the cluster. Do I need to remove it from all nodes?

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [October 31, 2023, 12:02pm UTC](https://forums.percona.com/t/audit-log-file-permission/26234/4 "2023-10-31T12:02:42Z")

</div>

Delete from all nodes. Install to all nodes.

---

<div class="post-metadata">

**Author:** ![bthnklc](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@bthnklc](https://forums.percona.com/u/bthnklc)\
**Post date:** [October 31, 2023, 7:56pm UTC](https://forums.percona.com/t/audit-log-file-permission/26234/5 "2023-10-31T19:56:50Z")

</div>

Does this process cause an interruption?

---

<div class="post-metadata">

**Author:** ![yunus\_shaikh](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yunus_shaikh/32/3512_2.png) [@yunus\_shaikh](https://forums.percona.com/u/yunus_shaikh)\
**Post date:** [November 1, 2023, 7:38am UTC](https://forums.percona.com/t/audit-log-file-permission/26234/6 "2023-11-01T07:38:12Z")

</div>

No, this should not cause an interruption to uninstall and install it back.