Check Details

• Resource: Azure Database for MySQL Flexible Server
• Check: Ensure audit_log_events Includes CONNECTION
• Risk: If connection events are not logged, unauthorized access attempts, suspicious logins, or brute-force attacks may go undetected. This can hinder incident response efforts and reduce overall visibility into database access activity.

Remediation via Azure Portal

1. Log in to the Azure Portal.
2. Navigate to Azure Database for MySQL Flexible Servers and select the affected server.
3. In the left-hand menu, select Server parameters under Settings.
4. Search for the parameter audit_log_events.
5. Ensure the value includes CONNECTION. If not present, modify the value to include CONNECTION along with any existing audit event types.
6. Click Save to apply the changes. A server restart may be required for the configuration to take effect.

Remediation via Azure CLI

1. Open Azure Cloud Shell or a local terminal with Azure CLI installed.

2. Check the current value of the audit_log_events parameter:

   

   az mysql flexible-server parameter show \
    --resource-group <resource-group> \
    --server-name <mysql-server-name> \
    --name audit_log_events
   

3. Update the parameter to include CONNECTION:

   

   az mysql flexible-server parameter set \
    --resource-group <resource-group> \
    --server-name <mysql-server-name> \
    --name audit_log_events \
    --value CONNECTION
   

4. Verify that the parameter now includes CONNECTION:

   

   az mysql flexible-server parameter show \
    --resource-group <resource-group> \
    --server-name <mysql-server-name> \
    --name audit_log_events \
    --query value
   

Replace <resource-group> and <mysql-server-name> with your actual values. The output should confirm that CONNECTION is included in the parameter value.