# Setting up and using the client-side audit logging feature
    
   The tiup cluster audit command is a useful debugging feature and is able to view commands executed on all clusters in the history and the execution log of each command.

## _Client based audit logging with TiDB_

--------------------------------------
    
Here the client takes care of creating audit logging of the statements that it sends to the server.

The default syslog server that comes with CentOS 8 is configured already in such a way that the MySQL client logging is written to a file. It is possible to reconfigure the syslog server to send this information to a central syslog host.

1. _Environment_
   
    ---------------
    A minimal install of CentOS 8 Stream as a VM

2. _Setup_
    
    ---------------
    
    ```bash
    dnf install -y tar

    curl --proto '=https' --tlsv1.2 -sSf <https://tiup-mirrors.pingcap.com/install.sh> | sh

    ./root/.bash\_profile

    tiup playground --tikv 0 --monitor=false &

    dnf install -y mysql
    ```

3. _Test_
    
    Run mysql with the --syslog option:

    ```bash
    mysql -u root -h 127.0.0.1 -P 4000 --comments --syslog
    ```

    Now in /var/log/messages you should see logging.

    ![Client Audit](/hc/article_attachments/4410263106455/image-0.png)

    _client audit_

4. _Availability_
    
   * MySQL Client 5.7.x and newer
   * MySQL Shell 8.0.24 and newer

5. _Documentation_

    ---------------
    
   * <https://dev.mysql.com/doc/refman/8.0/en/mysql-logging.html>
   * <https://dev.mysql.com/doc/mysql-shell/8.0/en/mysql-shell-sql-system-log.html>

6. _Other options_

    ---------------
    
    Having the auditing server side is often better. This makes circumventing the auditing a lot more difficult and doesn’t rely on client specific implementations. However if the auditing needs to audit/pass all traffic this can become a performance bottleneck.

    Another option is to use [ProxySQL Audit Log](https://proxysql.com/documentation/audit-log/) which does auditing on the proxy which is both secure and flexible. It however is yet another component to manage and for this functionality should not be colocated with the application for security.