6.1 Ensure 'log_error' is configured correctly

Information

The error log contains information about events such as mysqld starting and stopping, when a table needs to be checked or repaired, and, depending on the host operating system, stack traces when mysqld fails.

Rationale:

Enabling error logging can increase the ability to detect malicious attempts against MySQL, and other critical messages. For example, if the error log is not enabled then a connection error could go unnoticed.

When configured to stderr MySQL will send log data to the console. Logging to the console is useful, but remember it is ephemeral. This is not recommended due to the fact that logging to console does not provide a means to force restricted access via permissions strictly to MySQL and dedicated MySQL audit accounts. This may compromise the confidentiality of the MySQL log data. Furthermore use caution if co-mingling log data from multiple sources as that can complicate log inspection. Additionally from a security auditing perspective, it's difficult and error prone to verify logging is correct using stderr or redirected stderr.

Solution

Perform the following actions to remediate this setting:

Open the MySQL configuration file (my.cnf or my.ini).

Set the log-error option to the path for the error log.

Default Value:

stderr

See Also

https://workbench.cisecurity.org/files/3855

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: MySQLDB

Control ID: b17d0a7169cc46490843c88265f76eb68dc6b9a7e26a64ee18662c71c21b1884