Verify the MariaDB Enterprise Audit plugin is loaded and actively logging: MariaDB> SHOW GLOBAL STATUS LIKE 'Server_audit_active'; If the MariaDB Enterprise Audit is not active, this is a finding. As the database administrator, create a user without special permissions: MariaDB> CREATE USER testuser IDENTIFIED BY password ; In one terminal, tail the audit log file. For example: $ tail -F /var/lib/mysql/server_audit.log (default location) As the database administrator, create a role by running the following SQL: MariaDB> CREATE ROLE user_role As the database administrator, GRANT user_role to testuser: MariaDB> GRANT user_role to testuser As the database administrator, add two privileges to user_role for testdb and then delete one of the privileges: MariaDB> GRANT SELECT,DELETE on testdb to testuser As the testuser, remove the users delete privilege by granting only SELECT, and revoke grant from test user: MariaDB> GRANT SELECT on testdb to testuser MariaDB> REVOKE user_role to testuser If the audit records for REVOKE and the second SELECT are not produced in the first terminal, this is a finding.