# Audit log - MySQL setup

How to create the MySQL audit log database, including TLS connections.

This page shows how to prepare a MySQL server for the [audit log](https://zato.io/docs/admin/audit-log/index.html). MySQL 8.0 and later is supported.

## Creating the database and the user {#creating-the-database-and-the-user}

As an administrative user, create a database named `zato_audit_log` with the `utf8mb4` character set, and a user of the same name with full rights to that database. The audit log creates its table and indexes the first time a server connects.

Now, point the servers at the database:

```bash
export Zato_Audit_Log_DB_Type=mysql
export Zato_Audit_Log_DB_Host=db.example.com
export Zato_Audit_Log_DB_Port=3306
export Zato_Audit_Log_DB_Username=zato_audit_log
export Zato_Audit_Log_DB_Password=my.secret.password
export Zato_Audit_Log_DB_Name=zato_audit_log
```

## Enabling SSL/TLS on the server {#enabling-ssltls-on-the-server}

Point MySQL at its certificate files in `my.cnf`:

```ini
[mysqld]
ssl_ca   = /etc/mysql/certs/ca.crt
ssl_cert = /etc/mysql/certs/server.crt
ssl_key  = /etc/mysql/certs/server.key
```

To refuse all unencrypted TCP connections, add:

```ini
[mysqld]
require_secure_transport = ON
```

Alternatively, mark the `zato_audit_log` account as requiring SSL, which enforces TLS for that user alone, or as requiring X.509, which additionally demands a client certificate (mutual TLS).

With the server prepared, enable TLS on the client side:

```bash
export Zato_Audit_Log_DB_SSL=on
export Zato_Audit_Log_DB_SSL_CA_File=/path/to/ca.crt
```

And, when the user requires a client certificate:

```bash
export Zato_Audit_Log_DB_SSL_Cert_File=/path/to/client.crt
export Zato_Audit_Log_DB_SSL_Key_File=/path/to/client.key
```

All the client-side variables are described in the [audit log documentation](https://zato.io/docs/admin/audit-log/index.html).

## Learn more {#learn-more}

- [Production checklist](https://zato.io/docs/admin/production-checklist.html) - What to confirm before an environment takes real traffic
- [Audit log](https://zato.io/docs/admin/audit-log/) - Every request, response and error, and what you can do with them afterwards
- [Health checks](https://zato.io/docs/admin/health-checks.html) - Have Zato ping your outgoing connections instead of waiting for traffic to fail
- [Logging](https://zato.io/docs/admin/logging.html) - What is written where, and how to ship it to Splunk, Loki, Elastic or Datadog
- [GitOps with enmasse](https://zato.io/docs/admin/enmasse.html) - Keep the whole environment in git as YAML and import it anywhere