New answers tagged audit
The least disruptive method would be to use the general query log. The query log output can be a database table or a log (text) file; however it does not support filtering by DML operation or database so all SELECT statements on all databases will be logged as well. Obviously you can filter the logging output later. Also note: The session sql_log_off ...
One perfect example why root access even for admins is bad. Maintaining a sudoers file and a centralized database of privileged users and groups(LDAP for example) would help solving problems like this. One note: the wrongdoer might well be a cronjob. I'd check that.
Top 50 recent answers are included