AUDIT Plugin for MySQL. See wiki and readme for description. If you find the plugin useful, please star us on GitHub. We love stars and it's a great way to show your feedback.
License: Other
Hi,
Can we direct use mysql-audit for percona-server.
Currently we are using
Server version: 5.5.22-55-log Percona Server (GPL), Release rel25.2, Revision 237
While installing mysql-audit, its showing below error:
mysql> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';
ERROR 1123 (HY000): Can't initialize function 'AUDIT'; Plugin initialization function failed.
I tried both versions of mysql-audit 1.0.3 & 1.0.2.
Thanks in advance.
Vineet
is it possible to audit also login/logout activities as well?
Is there a reason there would be entries in the mysql_audit.log for invalid logins during the startup of MySQL using /etc/init.d/mysql start? I am seeing these and am not sure why.
Thanks,
Sandra Arnold
I
The replication user that shows up in the MySQL processlist is system user, its activity is logged with a blank user field
{"msg-type":"activity","date":"1357644515735","thread-id":"13","query-id":"11432","priv_user":"","cmd":"update","objects":[{"db":"","name":"","obj_type":"TABLE"}],"query":""}
The user field logged here is BLANK.
Hi There,
I tried below to get the offsets for Percona MySQL 5.1.57-rel12.8. I get below error, it appears that debuginfo module is not installed. Is that necessary to install in order to get the Audit working ?
[[email protected] ~]# /var/lib/mysql/software/offset-extract.sh /usr/sbin/mysqld
//offsets for: /usr/sbin/mysqld (5.1.57-rel12.8)
/root/offsets.gdb:2: Error in sourced command file:
No symbol table is loaded. Use the "file" command.,
When Audit plugin is used without offsets, then the plugin is not loaded and below is logged in the error log:
130523 21:52:21 [Note] Audit Plugin: starting up. Version: 1.0.3 , Revision: 371 (64bit). AUDIT plugin interface version: 50157. MySQL Server version: 5.1.57-rel12.8-log.
130523 21:52:21 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 1
130523 21:52:21 [Note] Audit Plugin: mysqld: /usr/sbin/mysqld (1ffa172df834cfe32cf1ff0b6f9b5600)
130523 21:52:21 [ERROR] Audit Plugin: Offsets: 5.1.57-community (4c6d32f80c20657983f7ac316c6a6e10) match thread validation check fails with value: 0. Skipping offest.
130523 21:52:21 [ERROR] Audit Plugin: Offsets: 5.1.57-community (4c6d32f80c20657983f7ac316c6a6e10) match thread validation check fails with value: 0. Skipping offest.
130523 21:52:21 [ERROR] Audit Plugin: Offsets: 5.1.57 (c3c4f7c4403e501b11c532fb4eccf68b) match thread validation check fails with value: 0. Skipping offest.
130523 21:52:21 [ERROR] Audit Plugin: Offsets: 5.1.57 (c3c4f7c4403e501b11c532fb4eccf68b) match thread validation check fails with value: 0. Skipping offest.
130523 21:52:21 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.1.57-rel12.8-log
130523 21:52:21 [ERROR] Plugin 'AUDIT' init function returned error.
130523 21:52:21 [Note] Audit Plugin: deinit
Thanks,
Zamir
Is it possible to add whitelist feature into the MySQL5.1 binaries?
Why does the audit log reports the date in Unix Timestamp format?
Shouldn't it be in a more Human Readable format?
Ankit
https://github.com/mcafee/mysql-audit/wiki/Configuration does not explain how audit_json_file_flush is used.
You have probably thought of this already, but it would be great if the log file support could do daily log file rotation. Having a single log file will undoubtedly become unweildly eventually, nor does it provide for easy archiving.
I am guessing for now, one could write their own log file roller if they use the socket option, but this means another process needs to run and an additional point of failure.
Error:
120912 11:16:26 [ERROR] Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 0 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: __cxa_pure_virtual)
120912 11:16:26 [ERROR] Couldn't load plugin named 'AUDIT' with soname 'libaudit_plugin.so'.
MySQL-server-5.5.25-1.el6.x86_64 (from MySQL website - RPM package for RHEL6 & Oracle Linux 6
root@mysql-slave:/home/pdobryakov/audit# mysql --version
mysql Ver 14.14 Distrib 5.5.22, for debian-linux-gnu (x86_64) using readline 6.1
root@mysql-slave:/home/pdobryakov/audit# uname -a
Linux mysql-slave.test1.alpari-ru.dom 3.2.0-1-amd64 #1 SMP Fri Feb 17 05:17:36 UTC 2012 x86_64 GNU/Linux
root@mysql-slave:/home/pdobryakov/audit# cat /etc/mysql/my.cnf
[mysqld]
.....................
audit_json_log_file=/var/lib/mysql/audit.log
audit_json_file=ON
audit_json_socket=OFF
audit_validate_checksum=OFF
plugin-load=AUDIT=libaudit_plugin.so
use audit-plugin-mysql-5.5-1.0.1-320-linux-x86_64.zip plugin
lines in error log
120411 14:10:37 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
120411 14:10:37 [Note] Plugin 'FEDERATED' is disabled.
120411 14:10:37 [Note] Audit Plugin: Set interface version to: 12933632 (50522)
120411 14:10:37 InnoDB: The InnoDB memory heap is disabled
120411 14:10:37 InnoDB: Mutexes and rw_locks use GCC atomic builtins
120411 14:10:37 InnoDB: Compressed tables use zlib 1.2.3.4
120411 14:10:37 InnoDB: Using Linux native AIO
120411 14:10:37 InnoDB: Initializing buffer pool, size = 128.0M
120411 14:10:37 InnoDB: Completed initialization of buffer pool
120411 14:10:37 InnoDB: highest supported file format is Barracuda.
120411 14:10:37 InnoDB: Waiting for the background threads to start
120411 14:10:38 InnoDB: 1.1.8 started; log sequence number 3923220777367
120411 14:10:38 [Note] Audit Plugin: starting up. Version: 1.0.1, Revision: 320. AUDIT plugin interface version: 50522. MySQL Server version: 5.5.22-1dotdeb.0-log.dotdeb.0-log
120411 14:10:38 [Note] Audit Plugin: setup_offsets offsets_string (null)
120411 14:10:38 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.22-1
120411 14:10:38 [ERROR] Plugin 'AUDIT' init function returned error.
120411 14:10:38 [Note] Audit Plugin: removing hot patching function: 0x5c7a2070
120411 14:10:38 [Note] Audit Plugin: targetPage: 0x5c7a2000 targetFunction: 0x5c7a2070
120411 14:10:38 [Note] Audit Plugin: removing hot patching function: 0x5c75c520
120411 14:10:38 [Note] Audit Plugin: targetPage: 0x5c75c000 targetFunction: 0x5c75c520
120411 14:10:38 [Note] Audit Plugin: removing hot patching function: 0x5c76cfe0
120411 14:10:38 [Note] Audit Plugin: targetPage: 0x5c76c000 targetFunction: 0x5c76cfe0
120411 14:10:38 [Note] Audit Plugin: removing hot patching function: 0x5c774160
120411 14:10:38 [Note] Audit Plugin: targetPage: 0x5c774000 targetFunction: 0x5c774160
120411 14:10:38 [Note] Audit Plugin: removing hot patching function: 0x5c7a1d70
120411 14:10:38 [Note] Audit Plugin: targetPage: 0x5c7a1000 targetFunction: 0x5c7a1d70
120411 14:10:38 [Note] Audit Plugin: removing hot patching function: 0x5c7a6d70
120411 14:10:38 [Note] Audit Plugin: targetPage: 0x5c7a6000 targetFunction: 0x5c7a6d70
120411 14:10:39 [Note] Event Scheduler: Loaded 168 events
120411 14:10:39 [Note] /usr/sbin/mysqld: ready for connections.
What the title says.
Thanks for sharing the plugin,
Fernando.
Sometimes having too much information in the logs can be dangerous and information can somehow be leaked to log files.
One example is when creating a new user, the user password would be written in plain text to the log file:
{"msg-type":"activity","date":"1348244195261","thread-id":"38","query-id":"126","user":"root","priv_user":"root","host":"localhost","ip":"127.0.0.1","cmd":"create_user","query":"CREATE USER 'T'@'%' IDENTIFIED BY 'AAA'"}
{"msg-type":"activity","date":"1348244195262","thread-id":"38","query-id":"127","user":"root","priv_user":"root","host":"localhost","ip":"127.0.0.1","cmd":"grant","query":"GRANT USAGE ON . TO 'T'@'%' IDENTIFIED BY 'AAA' WITH MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0"}
But it's still important to audit that the user "T" has been added.
I have MySQL successfully capturing any valid connections (logins) and logoffs (quit). However, can mysql-audit track unsuccessful logins (authentication failures)?
Thanks,
Sandra
In a higher version，1.0.4-435， crash again in produce enviroment， some message：
stack_bottom = 0x49a55100 thread_stack 0x40000
/usr/local/mysql/bin/mysqld(my_print_stacktrace+0x2e)[0x8aa18e]
/usr/local/mysql/bin/mysqld(handle_segfault+0x322)[0x5df7f2]
/lib64/libpthread.so.0[0x360200eb10]
/usr/local/mysql/bin/mysqld(strnmov+0x11)[0x8bba81]
/usr/local/mysql/bin/mysqld[0x6feea7]
/usr/local/mysql/bin/mysqld(_Z11fill_statusP3THDP10TABLE_LISTP4Item+0xc3)[0x6ff4a3]
/usr/local/mysql/bin/mysqld(_Z24get_schema_tables_resultP4JOIN23enum_schema_table_state+0x200)[0x6f29d0]
/usr/local/mysql/bin/mysqld(_ZN4JOIN4execEv+0x605)[0x658685]
/usr/local/mysql/bin/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x124)[0x654a34]
/usr/local/mysql/bin/mysqld(_Z13handle_selectP3THDP6st_lexP13select_resultm+0x16c)[0x65a32c]
/usr/local/mysql/bin/mysqld[0x5ececa]
/usr/local/mysql/bin/mysqld(_Z21mysql_execute_commandP3THD+0x3875)[0x5f3335]
/usr/local/mysql/bin/mysqld(Z11mysql_parseP3THDPKcjPS2+0x357)[0x5f55e7]
/usr/local/mysql/bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0xe93)[0x5f6483]
/usr/local/mysql/bin/mysqld(_Z10do_commandP3THD+0xe6)[0x5f6d46]
/usr/local/mysql/bin/mysqld(handle_one_connection+0x246)[0x5e96e6]
/lib64/libpthread.so.0[0x360200673d]
/lib64/libc.so.6(clone+0x6d)[0x36014d40cd]
but in a test environment， when unintall ， everything is ok
Is there any way to log user connections that don't actually execute any statements? i.e. just a connect and disconnect?
thanks,
Keith
using 1.01 version
root@mysql-slave:/home/pdobryakov/audit# mysql --version
mysql Ver 14.14 Distrib 5.5.21, for Linux (x86_64) using readline 5.1
root@mysql-slave:/home/pdobryakov/audit# uname -a
Linux mysql-slave.test1.alpari-ru.dom 3.2.0-1-amd64 #1 SMP Fri Feb 17 05:17:36 UTC 2012 x86_64 GNU/Linux
root@mysql-slave:/home/pdobryakov/audit# cat /etc/debian_version
6.0.4
mysql> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';
ERROR 1126 (HY000): Can't open shared library '/usr/lib/mysql/plugin/libaudit_plugin.so' (errno: 2 /usr/lib/mysql/plugin/libaudit_plugin.so: undefined symbol: __cxa_pure_virtual)
ls -la /usr/lib/mysql/plugin
drwxr-xr-x 2 root root 4096 Apr 11 13:24 .
drwxr-xr-x 3 root root 4096 Jan 30 16:30 ..
.......
-rw-r--r-- 1 root root 714858 Mar 15 19:50 libaudit_plugin.so
........
Hi There,
Could this plugin be configured to use a table in the database to record the audit trail information in addition or instead of writing on a text file, such as oracle does. If not currently, can this be added as a future enhancement and how could it be achieved with the current plugin.
Thanks.
Zamir.
Every time I try to use the socket I get this error in my mysql log ...
120716 23:52:02 [ERROR] Audit Plugin: unable to connect to socket: /mnt/mysqltmp/mysql-audit.sock. err: Connection refused. audit socket handler disabled!!
I've got the plugin installed and the log file works just fine, but when i try to use the socket it doesn't work.
Am I missing a special step which needs to be done for this to work?
Hi,
After Mysql security update to 5.5.32 on Ubuntu 12.04.1 I can't load audit plugin anymore:
MySQL CLI:
mysql> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so'; ERROR 1123 (HY000): Can't initialize function 'AUDIT'; Plugin initialization function failed. mysql> show global status like 'AUDIT_version'; Empty set (0.00 sec)
my.cnf:
plugin-load=AUDIT=libaudit_plugin.so audit_json_log_file = /var/lib/mysql/mysql-audit.json audit_json_file = 1 audit-json-file-sync = 200 audit_record_cmds = Connect,Quit,Insert,Update,Delete audit_record_objs = mydb.mytable
MySQL error.log:
tail -f /var/log/mysql/error.log | grep AUDIT 130813 11:58:40 [Note] Audit Plugin: starting up. Version: 1.0.3 , Revision: 371 (64bit). AUDIT plugin interface version: 50532. MySQL Server version: 5.5.32-0ubuntu0.12.04.1-log. 130813 11:58:40 [ERROR] Plugin 'AUDIT' init function returned error.
MySQL version:
root@app3 /var/backups/mysql/orem # dpkg -l | grep mysql-server ii mysql-server 5.5.32-0ubuntu0.12.04.1 MySQL database server (metapackage depending on the latest version) ii mysql-server-core-5.5 5.5.32-0ubuntu0.12.04.1 MySQL database server binaries
Is MySQL 5.5.32 supported?
Cheers
Could you please provide me with the offsets for MySQL 5.5.31 on CentOS 5.9? I am required to install MySQL 5.5.31.
Thanks,
Sandra Arnold
when setting audit_record_cmds and audit_record_objs the commands no associated with specific objects (set_option,grant,drop ...) are also not logged.
Suggestion: audit_record_objs should only by applied only when there is/are object(s) associated.
When I try to set audit_json_file or audit_json_socket in my.cnf, the daemon starts up, but when I look at the global variables via show global variables like 'audit%' they still show as OFF, and I do not see any logging happening in the mysql-audit.json file either.
Its pretty strange because other boolean globals like audit_validate_checksum can be set in my.cnf and their value is recognized.
Thoughts?
I see the same behavior using the precomiled audit-plugin-mysql-5.1 and when compiling my own.
[mysqld]
plugin-load=AUDIT=libaudit_plugin.so
audit_validate_checksum=OFF
audit_offsets=6336, 6400, 3696, 3968, 88, 2048
audit_json_file=ON
audit_delay_cmds=insert,select
What format is the Date that appears in the Audit_Log? Is there a way to change this format?
Thanks,
Sandra Arnold
When will the latest commit be available for download?
Greetings, I'm having issues installing the MySQL plugin of McAfee Database Security on Debian . I've tried the two procedures indicated in the documentation receiving the following errors:
MySQL> INSTALL PLUGIN AUDIT SONAME 'libaudit_plugin.so';
ERROR 1123 (HY000): Can't initialize function 'AUDIT'; Plugin initialization function failed.
The problem probably is that the OFFSET parameters should be indicated but we don't know them and we were unable to run the ./offset-extract.sh /usr/sbin/mysqld to find them. It trows the next error:
root@Debian64:/etc/mysql# ./offset-extract.sh /usr/sbin/mysqld
set logging on
printf "{"5.5.28-1","2eaab403212b52f78a22835c79d15175", %d, %d, %d, %d, %d, %d}", ((size_t)&((THD )log_slow_statement)->query_id) - (size_t)log_slow_statement, ((size_t)&((THD *)log_slow_statement)->thread_id) - (size_t)log_slow_statement, ((size_t)&((THD *)log_slow_statement)->main_security_ctx) - (size_t)log_slow_statement, ((size_t)&((THD *)log_slow_statement)->command) - (size_t)log_slow_statement, ((size_t)&((THD *)log_slow_statement)->lex) - (size_t)log_slow_statement, (size_t)&((LEX)log_slow_statement)->comment - (size_t) log_slow_statement
//offsets for: /usr/sbin/mysqld (5.5.28-1)
/etc/mysql/offsets.gdb:2: Error in sourced command file:
No symbol table is loaded. Use the "file" command.,
Using the parameter audit_validate_checksum=OFF doesn't fx the problem either.
We've tried with different versions of MySQL Server 5.5.28-1~dotdeb.0. and MySql 5.1
Please help us, what can we try now? Any information should be useful, thanks in advance,
mysql 5.5.29 32-bit, compiled from source, offsets fetched with offset-extract and manually added to mysql-audit source code:
{"5.5.29","8e59768a63e8e4ece2e2acd41f375dac", 3788, 3816, 2340, 2672, 44, 1644}
I start up the server, load the plugin via my.cnf and set audit_uninstall_plugin=ON there.
When the server automatically restarts after a segfault (via --log-error):
130129 10:57:22 mysqld_safe Number of processes running now: 0
130129 10:57:22 mysqld_safe mysqld restarted
130129 10:57:22 [Note] Audit Plugin: Set interface version to: 12935424 (50529)
130129 10:57:22 InnoDB: The InnoDB memory heap is disabled
130129 10:57:22 InnoDB: Mutexes and rw_locks use GCC atomic builtins
130129 10:57:22 InnoDB: Compressed tables use zlib 1.2.3.4
130129 10:57:22 InnoDB: Initializing buffer pool, size = 128.0M
130129 10:57:22 InnoDB: Completed initialization of buffer pool
130129 10:57:22 InnoDB: highest supported file format is Barracuda.
130129 10:57:23 InnoDB: Waiting for the background threads to start
130129 10:57:24 InnoDB: 1.1.8 started; log sequence number 4153100308
130129 10:57:24 [Note] Audit Plugin: starting up. Version: 1.0.0 , Revision: 99999 (32bit). AUDIT plugin interface version: 50529. MySQL Server version: 5.5.29.
130129 10:57:24 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 1
130129 10:57:24 [Note] Audit Plugin: mysqld: /usr/local/mysql/bin/mysqld (8e59768a63e8e4ece2e2acd41f375dac)
130129 10:57:24 [Note] Audit Plugin: Checksum verified. Using offsets from offset version: 5.5.29 (8e59768a63e8e4ece2e2acd41f375dac)
130129 10:57:24 [Note] Audit Plugin: mem func addr: 0x1208b0 mem start addr: 0x121000 page size: 4096
130129 10:57:24 [Note] Audit Plugin: hot patching function: 0x819f0a0, trampolineFunction: 0x121000 trampolinePage: 0x121000
130129 10:57:24 [Note] Audit Plugin: hot patch for: log_slow_statement (0x819f0a0) complete. Audit func: 0x124780, Trampoline address: 0x121000 size: 7.
130129 10:57:24 [Note] Audit Plugin: hot patching function: 0x81a3970, trampolineFunction: 0x121010 trampolinePage: 0x121000
130129 10:57:24 [Note] Audit Plugin: hot patch for: mysql_execute_command (0x81a3970) complete. Audit func: 0x124cd0, Trampoline address: 0x121010 size: 10.
130129 10:57:24 [Note] Audit Plugin: hot patching function: 0x8169d30, trampolineFunction: 0x121020 trampolinePage: 0x121000
130129 10:57:24 [Note] Audit Plugin: hot patch for: acl_authenticate (0x8169d30) complete. Audit func: 0x124800, Trampoline address: 0x121020 size: 6.
130129 10:57:24 [Note] Audit Plugin: hot patching function: 0x817a610, trampolineFunction: 0x121030 trampolinePage: 0x121000
130129 10:57:24 [Note] Audit Plugin: hot patch for: send_result_to_client (0x817a610) complete. Audit func: 0x124870, Trampoline address: 0x121030 size: 6.
130129 10:57:24 [Note] Audit Plugin: hot patching function: 0x81a0230, trampolineFunction: 0x121040 trampolinePage: 0x121000
130129 10:57:24 [Note] Audit Plugin: hot patch for: check_table_access (0x81a0230) complete. Audit func: 0x123a30, Trampoline address: 0x121040 size: 7.
130129 10:57:24 [Note] Audit Plugin: hot patching function: 0x8176660, trampolineFunction: 0x121050 trampolinePage: 0x121000
130129 10:57:24 [Note] Audit Plugin: hot patch for: open_tables (0x8176660) complete. Audit func: 0x1249b0, Trampoline address: 0x121050 size: 10.
130129 10:57:24 [Note] Audit Plugin: Init completed successfully.
130129 10:57:24 [Note] Server hostname (bind-address): '127.0.0.1'; port: 3306
130129 10:57:24 [Note] - '127.0.0.1' resolves to '127.0.0.1';
130129 10:57:24 [Note] Server socket created on IP: '127.0.0.1'.
130129 10:57:24 [Note] Event Scheduler: Loaded 0 events
130129 10:57:24 [Note] /usr/local/mysql/bin/mysqld: ready for connections.
Version: '5.5.29' socket: '/var/run/mysqld/mysqld.sock' port: 3306 Source distribution
"uninstall plugin audit" from the mysql CLI leads to following:
130129 10:58:10 [Note] Audit Plugin: removing hot patching function: 0x819f0a0 targetPage: 0x819f000 trampolineFunction: 0x121000
130129 10:58:10 [Note] Audit Plugin: removing hot patching function: 0x8169d30 targetPage: 0x8169000 trampolineFunction: 0x121020
130129 10:58:10 [Note] Audit Plugin: removing hot patching function: 0x8176660 targetPage: 0x8176000 trampolineFunction: 0x121050
130129 10:58:10 [Note] Audit Plugin: removing hot patching function: 0x817a610 targetPage: 0x817a000 trampolineFunction: 0x121030
130129 10:58:10 [Note] Audit Plugin: removing hot patching function: 0x81a0230 targetPage: 0x81a0000 trampolineFunction: 0x121040
130129 10:58:10 [Note] Audit Plugin: removing hot patching function: 0x81a3970 targetPage: 0x81a3000 trampolineFunction: 0x121010
130129 10:58:10 [Note] Audit Plugin: deinit
07:58:10 UTC - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.
key_buffer_size=16777216
read_buffer_size=131072
max_used_connections=1
max_threads=151
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 346064 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Thread pointer: 0x909bf08
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
Segmentation fault
when uninstall plugin audit ,mysql crash....
some thins in errlor log:
130608 15:18:13 [Note] Audit Plugin: removing hot patching function: 0x5744d0 targetPage: 0x574000 trampolineFunction: 0x7ff3f813d000
130608 15:18:13 [Note] Audit Plugin: removing hot patching function: 0x52d550 targetPage: 0x52d000 trampolineFunction: 0x7ff3f813d040
130608 15:18:13 [Note] Audit Plugin: removing hot patching function: 0x544020 targetPage: 0x544000 trampolineFunction: 0x7ff3f813d0a0
130608 15:18:13 [Note] Audit Plugin: removing hot patching function: 0x54b510 targetPage: 0x54b000 trampolineFunction: 0x7ff3f813d060
130608 15:18:13 [Note] Audit Plugin: removing hot patching function: 0x576960 targetPage: 0x576000 trampolineFunction: 0x7ff3f813d080
130608 15:18:13 [Note] Audit Plugin: removing hot patching function: 0x579530 targetPage: 0x579000 trampolineFunction: 0x7ff3f813d020
130608 15:18:13 [Note] Audit Plugin: deinit
07:18:13 UTC - mysqld got signal 11 ;
.......
.......
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (ad5c380): UNINSTALL PLUGIN audit
Connection ID (thread ID): 1
Status: NOT_KILLED
MySQL: 5.6.11 enterprise;
AUDIT: 1.0.4-437
using the installation command: install plugin AUDIT soname 'libaudit_plugin.so' and got an error:
ERROR 2013 (HY000) : Lost connection to MySQL server during query
The audit plugin crashes mysqld under some circumstances. I can't reproduce but this is the 2nd occurrence.
Here is the addr2line output for the relative address I get at the top of the crash stack trace.
sh# addr2line -fie /usr/local/mysql/lib/plugin/libaudit_plugin.so 0xd9a9
audit
/usr/local/src/mysql-audit/src/audit_plugin.cc:665
sh# addr2line -fie /usr/local/mysql/lib/plugin/libaudit_plugin.so 0xddf8
audit_log_slow_statement
/usr/local/src/mysql-audit/src/audit_plugin.cc:1013
Kind of weird.
The plugin is compiled from the current mysql-audit master with some offsets added for Percona Server : https://github.com/ravelry/mysql-audit/blob/bc0a5770ec416b344331616881708fef9454bd83/src/audit_plugin.cc#L665
Mysql backtrace:
Thread pointer: 0x7ef6f008c660
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7ef707923e48 thread_stack 0x40000
/usr/local/mysql/bin/mysqld(my_print_stacktrace+0x33)[0x78ab13]
/usr/local/mysql/bin/mysqld(handle_segfault+0x470)[0x517770]
/lib64/libpthread.so.0(+0xf4d0)[0x7f0d70af44d0]
/lib64/libc.so.6(+0x11691f)[0x7f0d6f26b91f]
/usr/local/mysql/lib/plugin/libaudit_plugin.so(+0xd9a9)[0x7ef70566a9a9]
/usr/local/mysql/lib/plugin/libaudit_plugin.so(+0xddf8)[0x7ef70566adf8]
/usr/local/mysql/bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x1df)[0x58940f]
/usr/local/mysql/bin/mysqld(_Z24do_handle_one_connectionP3THD+0x393)[0x619dc3]
/usr/local/mysql/bin/mysqld(handle_one_connection+0x4a)[0x619eba]
/usr/local/mysql/bin/mysqld(pfs_spawn_thread+0x54)[0x7e84a4]
/lib64/libpthread.so.0(+0x6d4c)[0x7f0d70aebd4c]
/lib64/libc.so.6(clone+0x6d)[0x7f0d6f22c40d]
Libc version is 2.13
Hello everyone
I observed a strange behaviour when configuring the audit_record_cmds and audit_record_objs variables, it seems every query is only logged once...
mysql> select * from example; --> appears in log
mysql> select * from example; --> does not appear in log
mysql> select data from example where id=1; --> appears in log
mysql> select data from example where id=2; --> appears in log
mysql> select data from example where id=1; --> does not appear in log
mysql> select data from example where id=2; --> does not appear in log
…
The following global variables are configured
audit_record_cmds = "select,update,delete"
audit_record_objs = “db.example”
audit_json_file = ON
audit_json_log_file = "/tmp/audit.log"
When the audit_record_* variables are not configured every query appears in the log file as it should.
I am using mysql-server-5.5=5.5.27-0ubuntu2 for ubuntu 12.10 and the most recent 64 bit Version of the plugin audit-plugin-mysql-5.5-1.0.3-371-linux-x86_64.zip
Am I doing something wrong, or won't these versions go with each other?
When I try to compile the plugin with:
and using the plugin from audit-plugin-mysql-5.5-1.0.3-371-linux-x86_64.zip:
130401 20:40:03 [Note] Audit Plugin: starting up. Version: 1.0.3 , Revision: 371 (64bit). AUDIT plugin interface version: 50530. MySQL Server version: 5.5.30-30.1-log.
130401 20:40:03 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 1
130401 20:40:03 [Note] Audit Plugin: mysqld: /usr/sbin/mysqld (d1d76892097b3c05ac2cffe18e832561)
130401 20:40:03 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.30-30.1-log
130401 20:40:03 [ERROR] Plugin 'AUDIT' init function returned error.
130401 20:40:03 [Note] Audit Plugin: deinit
Problem: Setting the parameter audit_whitelist_users (The Plugin was compiled from source code) using command set global causes MySQL to crash
Steps to reproduce:
mysql> select connection_id();
+-----------------+
| connection_id() |
+-----------------+
| 1 |
+-----------------+
1 row in set (0.00 sec)
mysql> show variables like '%audit%';
+---------------------------------+---------------------------------+
| Variable_name | Value |
+---------------------------------+---------------------------------+
| audit_checksum | |
| audit_delay_cmds | |
| audit_delay_ms | 0 |
| audit_json_file | OFF |
| audit_json_file_flush | OFF |
| audit_json_file_sync | 0 |
| audit_json_log_file | /var/lib/mysql/audit.log |
| audit_json_socket | ON |
| audit_json_socket_name | /var/lib/mysql/mysql-audit.sock |
| audit_offsets | |
| audit_offsets_by_version | ON |
| audit_record_cmds | |
| audit_record_objs | sakila.,mysql.,{} |
| audit_uninstall_plugin | OFF |
| audit_validate_checksum | ON |
| audit_validate_offsets_extended | ON |
| audit_whitelist_users | doctor |
+---------------------------------+---------------------------------+
17 rows in set (0.00 sec)
mysql> set global audit_whitelist_users='root';
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql> show plugins;
ERROR 2006 (HY000): MySQL server has gone away
No connection. Trying to reconnect...
Connection id: 1
Current database: *** NONE ***
mysql Ver 14.14 Distrib 5.5.12, for Linux (x86_64) using readline 5.1
Connection id: 1
Current database: information_schema
Current user: root@localhost
SSL: Not in use
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.5.12-log MySQL Community Server (GPL)
Protocol version: 10
Connection: Localhost via UNIX socket
Server characterset: latin1
Db characterset: utf8
Client characterset: utf8
Conn. characterset: utf8
UNIX socket: /var/lib/mysql/mysql.sock
Uptime: 5 min 50 sec
Threads: 1 Questions: 10 Slow queries: 0 Opens: 33 Flush tables: 1 Open tables: 26 Queries per second avg: 0.28
mysql> show global status like 'AUDIT_version';
+---------------+-------------+
| Variable_name | Value |
+---------------+-------------+
| AUDIT_version | 1.0.0-99999 |
+---------------+-------------+
1 row in set (0.00 sec)
Manual compilation cause of this version display ?
Version: '5.5.12-log' socket: '/var/lib/mysql/mysql.sock' port: 3306 MySQL Community Server (GPL)
130108 21:29:06 - mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.
key_buffer_size=268435456
read_buffer_size=1048576
max_used_connections=1
max_threads=151
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 573110 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Thread pointer: 0x30d0da0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f2e841f7e50 thread_stack 0x40000
/usr/sbin/mysqld(my_print_stacktrace+0x39)[0x796609]
/usr/sbin/mysqld(handle_segfault+0x380)[0x4fcdf0]
/lib64/libpthread.so.0[0x302b80f500]
/lib64/libc.so.6(gsignal+0x35)[0x302b4328a5]
/lib64/libc.so.6(abort+0x175)[0x302b434085]
/lib64/libc.so.6[0x302b46fa37]
/lib64/libc.so.6[0x302b475366]
/usr/lib64/mysql/plugin/libaudit_plugin.so(+0xbb6c)[0x7f2e85cdab6c]
/usr/sbin/mysqld(_ZN17sys_var_pluginvar13global_updateEP3THDP7set_var+0x45)[0x57f615]
/usr/sbin/mysqld(_ZN7sys_var6updateEP3THDP7set_var+0x6b)[0x5102ab]
/usr/sbin/mysqld(_ZN7set_var6updateEP3THD+0x1a)[0x51159a]
/usr/sbin/mysqld(_Z17sql_set_variablesP3THDP4ListI12set_var_baseE+0x89)[0x510909]
/usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x2881)[0x575c91]
/usr/lib64/mysql/plugin/libaudit_plugin.so(+0xd5ff)[0x7f2e85cdc5ff]
/usr/sbin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x15a)[0x577a6a]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x1321)[0x5795e1]
/usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x337)[0x60d3b7]
/usr/sbin/mysqld(handle_one_connection+0x54)[0x60d424]
/lib64/libpthread.so.0[0x302b807851]
/lib64/libc.so.6(clone+0x6d)[0x302b4e767d]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x7f2e4c004c00): is an invalid pointer
Connection ID (thread ID): 1
Status: NOT_KILLED
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.
130108 21:29:06 mysqld_safe Number of processes running now: 0
130108 21:29:06 mysqld_safe mysqld restarted
130108 21:29:06 [Note] Plugin 'FEDERATED' is disabled.
130108 21:29:06 [Note] Audit Plugin: Set interface version to: 12931072 (50512)
130108 21:29:06 InnoDB: The InnoDB memory heap is disabled
130108 21:29:06 InnoDB: Mutexes and rw_locks use GCC atomic builtins
130108 21:29:06 InnoDB: Compressed tables use zlib 1.2.3
130108 21:29:06 InnoDB: Using Linux native AIO
130108 21:29:06 InnoDB: Initializing buffer pool, size = 256.0M
130108 21:29:06 InnoDB: Completed initialization of buffer pool
130108 21:29:06 InnoDB: highest supported file format is Barracuda.
130108 21:29:07 InnoDB: Waiting for the background threads to start
130108 21:29:08 InnoDB: 1.1.6 started; log sequence number 8579063
130108 21:29:08 [Note] Audit Plugin: starting up. Version: 1.0.0 , Revision: 99999 (64bit). AUDIT plugin interface version: 50512. MySQL Server version: 5.5.12-log.
130108 21:29:08 [Note] Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 1
130108 21:29:08 [Note] Audit Plugin: mysqld: /usr/sbin/mysqld (5c99498c2d73b4c4789ed85b85166fef)
130108 21:29:08 [Note] Audit Plugin: extended offsets validate res: MySQL thread id 123456, query id 789 aud_tusr
130108 21:29:08 [Note] Audit Plugin: Using offsets from offset version: 5.5.12 (91df7918803df78b164f46706003e22d)
130108 21:29:08 [Note] Audit Plugin: Set num_whitelist_users: 1
130108 21:29:08 [Note] Audit Plugin: Set num_record_objs: 3 record objs: sakila.,mysql.,{}
130108 21:29:08 [Note] Audit Plugin: mem func addr: 0x7ff1c60789b0 mem start addr: 0x7ff1c6079000 page size: 4096
130108 21:29:08 [Note] Audit Plugin: hot patching function: 0x56fa80, trampolineFunction: 0x7ff1c6079000 trampolinePage: 0x7ff1c6079000
130108 21:29:08 [Note] Audit Plugin: hot patch for: log_slow_statement (0x56fa80) complete. Audit func: 0x7ff1c607c010, Trampoline address: 0x7ff1c6079000 size: 16.
130108 21:29:08 [Note] Audit Plugin: hot patching function: 0x573410, trampolineFunction: 0x7ff1c6079020 trampolinePage: 0x7ff1c6079000
130108 21:29:08 [Note] Audit Plugin: hot patch for: mysql_execute_command (0x573410) complete. Audit func: 0x7ff1c607c470, Trampoline address: 0x7ff1c6079020 size: 15.
130108 21:29:08 [Note] Audit Plugin: hot patching function: 0x52bdf0, trampolineFunction: 0x7ff1c6079040 trampolinePage: 0x7ff1c6079000
130108 21:29:08 [Note] Audit Plugin: hot patch for: acl_authenticate (0x52bdf0) complete. Audit func: 0x7ff1c607bcb0, Trampoline address: 0x7ff1c6079040 size: 14.
130108 21:29:08 [Note] Audit Plugin: hot patching function: 0x544510, trampolineFunction: 0x7ff1c6079060 trampolinePage: 0x7ff1c6079000
130108 21:29:08 [Note] Audit Plugin: hot patch for: send_result_to_client (0x544510) complete. Audit func: 0x7ff1c607be90, Trampoline address: 0x7ff1c6079060 size: 15.
130108 21:29:08 [Note] Audit Plugin: hot patching function: 0x56f210, trampolineFunction: 0x7ff1c6079080 trampolinePage: 0x7ff1c6079000
130108 21:29:08 [Note] Audit Plugin: hot patch for: check_table_access (0x56f210) complete. Audit func: 0x7ff1c607bd00, Trampoline address: 0x7ff1c6079080 size: 14.
130108 21:29:08 [Note] Audit Plugin: hot patching function: 0x53fa30, trampolineFunction: 0x7ff1c60790a0 trampolinePage: 0x7ff1c6079000
130108 21:29:08 [Note] Audit Plugin: hot patch for: open_tables (0x53fa30) complete. Audit func: 0x7ff1c607bc60, Trampoline address: 0x7ff1c60790a0 size: 15.
130108 21:29:08 [Note] Audit Plugin: Init completed successfully.
130108 21:29:08 [Note] Recovering after a crash using mysql-bin
130108 21:29:08 [Note] Starting crash recovery...
130108 21:29:08 [Note] Crash recovery finished.
130108 21:29:08 [Note] Event Scheduler: Loaded 0 events
130108 21:29:08 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.5.12-log' socket: '/var/lib/mysql/mysql.sock' port: 3306 MySQL Community Server (GPL)
Hi,
I am unable to install the plugin on a server that I have just upgraded to 5.5.30. The error log shows the following:
130321 16:40:25 [ERROR] Can't open shared library '/local/0/opt/MySQL/5.5.30/lib/plugin/libaudit_plugin.so' (errno: 0 /local/0/opt/MySQL/5.5.30/lib/plugin/libaudit_plugin.so: undefined symbol: _Z11open_tablesP3THDPP10TABLE_LISTPjj)
130321 16:40:25 [ERROR] Couldn't load plugin named 'AUDIT' with soname 'libaudit_plugin.so'.
I've tried adding the offsets for 5.5.30 but get get this in the error file:
plugin-load=AUDIT=libaudit_plugin.so
audit_validate_checksum=OFF
audit_offsets=6064, 6112, 3816, 4240, 88, 2568
130321 16:37:29 [ERROR] /local/0/opt/MySQL/5.5.30/bin/mysqld: unknown variable 'audit_offsets=6064, 6112, 3816, 4240, 88, 2568'
130321 16:37:29 [ERROR] Aborting
autoconf (GNU Autoconf) 2.68
automake (GNU automake) 1.11.3
3.2.0-38-generic x86_64
mysql-5.6.10 compiled from vanilla sources, same errors with ubuntu sources
bootstrap.sh and configure seems ok (latter raise an /bin/rm: cannot remove `libtoolT': No such file or directory)
but make dies with:
cc1plus: error: command line option '-Wimplicit' is valid for C/ObjC but not for C++ [-Werror]
removing -Wimplicit foreach Makefile, there are a lot of format string errors on hot_patch.cc (len printed as %d while it's a %zu)
audit_plugin.cc (res as %d while it's a %zd , and others %lu printed as %d)
fixing all these format errors (diff available if needed) make dies screaming:
audit_plugin.cc: In function 'int setup_offsets()':
audit_plugin.cc:1147:5: error: 'my_MD5Context' was not declared in this scope
audit_plugin.cc:1147:19: error: expected ';' before 'context'
audit_plugin.cc:1148:17: error: 'context' was not declared in this scope
audit_plugin.cc:1148:24: error: 'my_MD5Init' was not declared in this scope
audit_plugin.cc:1161:54: error: 'my_MD5Update' was not declared in this scope
audit_plugin.cc:1167:41: error: 'my_MD5Final' was not declared in this scope
I faced 2 more instances of MySQL crash, I deployed the plugin on one of our Replica DB, but it crashed twice in span of 8 hours on its own.
mysql Ver 14.14 Distrib 5.5.12, for Linux (x86_64) using readline 5.1
Connection id: 16215
Current database:
Current user: root@localhost
SSL: Not in use
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.5.12-log MySQL Community Server (GPL)
Protocol version: 10
Connection: Localhost via UNIX socket
Server characterset: utf8
Db characterset: utf8
Client characterset: utf8
Conn. characterset: utf8
UNIX socket: /var/lib/mysql/mysql.sock
Uptime: 1 day 28 min 35 sec
Threads: 74 Questions: 20112136 Slow queries: 210 Opens: 11200 Flush tables: 1 Open tables: 1000 Queries per second avg: 228.248
mysql> show global status like 'AUDIT_version';
+---------------+-------------+
| Variable_name | Value |
+---------------+-------------+
| AUDIT_version | 1.0.0-99999 |
+---------------+-------------+
1 row in set (0.00 sec)
plugin-load=AUDIT=libaudit_plugin.so
audit_json_file=ON
audit_json_log_file=/var/lib/mysql/mysql-audit.log
audit_json_socket=OFF
audit_validate_checksum=OFF
audit_record_cmds=select,Connect,Quit
audit_record_objs=ebay.,ebay_smpi.,shipping.,dwh.,analytics.*,{}
130109 5:12:05 - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.
key_buffer_size=1073741824
read_buffer_size=524288
max_used_connections=52
max_threads=2000
thread_count=41
connection_count=41
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 4143341 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Thread pointer: 0x25cec360
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7fecbeb9de50 thread_stack 0x40000
/usr/sbin/mysqld(my_print_stacktrace+0x39)[0x796609]
/usr/sbin/mysqld(handle_segfault+0x380)[0x4fcdf0]
/lib64/libpthread.so.0(+0xf4a0)[0x7ff2658834a0]
/lib64/libc.so.6(+0x130752)[0x7ff264b3b752]
/usr/lib64/mysql/plugin/libaudit_plugin.so(+0xca7a)[0x7ff216dc9a7a]
/usr/lib64/mysql/plugin/libaudit_plugin.so(+0xd078)[0x7ff216dca078]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x205)[0x5784c5]
/usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x337)[0x60d3b7]
/usr/sbin/mysqld(handle_one_connection+0x54)[0x60d424]
/lib64/libpthread.so.0(+0x77f1)[0x7ff26587b7f1]
/lib64/libc.so.6(clone+0x6d)[0x7ff264af092d]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query ((nil)): is an invalid pointer
Connection ID (thread ID): 8193
Status: NOT_KILLED
{"msg-type":"activity","date":"1357688525201","thread-id":"8193","query-id":"0","user":"username","priv_user":"username","ip":"Some IP","cmd":"Connect","query":"Connect"}
{"msg-type":"activity","date":"1357688525203","thread-id":"8193","query-id":"15158714","user":"username","priv_user":"username","ip":"Some IP","cmd":"select","query":"select @@version_comment limit 1"}
{"msg-type":"activity","date":"1357688525204","thread-id":"8193","query-id":"15158717","user":"username","priv_user":"username","ip":"Some IP","cmd":"select","objects":[{"db":"dwh","name":"table_name","obj_type":"TABLE"}],"query":"SELECT CONCAT("total_line_read : ",lines_input," total_lines_written: ",lines_output," lines_rejected: ",lines_input - lines_output -lines_rejected," lines_error: ",lines_rejected ," flow_completed_on: ",logdate) Message_below FROM dwh.table_name WHERE columnname = 'xxx_xxxxxx_xxxx_xxxxxxxx' ORDER BY logdate DESC LIMIT 0 , 1"}
plugin-load=AUDIT=libaudit_plugin.so
audit_json_file=OFF
audit_json_log_file=/var/lib/mysql/mysql-audit.log
audit_json_socket=OFF
audit_validate_checksum=OFF
audit_record_cmds=select,Connect,Quit
audit_record_objs=ebay.,ebay_smpi.,shipping.,dwh.,analytics.*,{}
130109 12:38:43 - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.
key_buffer_size=1073741824
read_buffer_size=524288
max_used_connections=53
max_threads=2000
thread_count=50
connection_count=50
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 4143341 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Thread pointer: 0x24d65430
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f4a5183de50 thread_stack 0x40000
/usr/sbin/mysqld(my_print_stacktrace+0x39)[0x796609]
/usr/sbin/mysqld(handle_segfault+0x380)[0x4fcdf0]
/lib64/libpthread.so.0(+0xf4a0)[0x7f4ff8f2e4a0]
/lib64/libc.so.6(+0x130752)[0x7f4ff81e6752]
/usr/lib64/mysql/plugin/libaudit_plugin.so(+0xca7a)[0x7f4faadc9a7a]
/usr/lib64/mysql/plugin/libaudit_plugin.so(+0xd078)[0x7f4faadca078]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x205)[0x5784c5]
/usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x337)[0x60d3b7]
/usr/sbin/mysqld(handle_one_connection+0x54)[0x60d424]
/lib64/libpthread.so.0(+0x77f1)[0x7f4ff8f267f1]
/lib64/libc.so.6(clone+0x6d)[0x7f4ff819b92d]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query ((nil)): is an invalid pointer
Connection ID (thread ID): 5133
Status: NOT_KILLED
No Session details available as audit_json_file=OFF
Hi,
I haven't been able to install this plugin to mySQL 5.1.63-0+squeeze1-log.
Via the INSTALL PLUGIN command I get the following message:
ERROR 1123 (HY000): Can't initialize function 'AUDIT'; Plugin initialization function failed.
Via plugin-load I get the following error in the log:
121201 23:39:08 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
121201 23:39:08 [Warning] '--log' is deprecated and will be removed in a future release. Please use ''--general_log'/'--general_log_file'' instead.
121201 23:39:08 [Note] Plugin 'FEDERATED' is disabled.
121201 23:39:08 [Note] Audit Plugin: Set interface version to: 12841728 (50163)
121201 23:39:08 InnoDB: Initializing buffer pool, size = 8.0M
121201 23:39:08 InnoDB: Completed initialization of buffer pool
121201 23:39:09 InnoDB: Started; log sequence number 0 33271781
121201 23:39:09 [Note] Audit Plugin: starting up. Version: 1.0.2 , Revision: 345 (32bit). AUDIT plugin interface version: 50163. MySQL Server version: 5.1.63-0+squeeze1-log.
121201 23:39:09 [Note] Audit Plugin: setup_offsets audit_offsets: (null)
121201 23:39:09 [Note] Audit Plugin: Validate checksum enabled. Mysqld /usr/sbin/mysqld
121201 23:39:09 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.1.63-0+squeeze1-log
121201 23:39:09 [ERROR] Plugin 'AUDIT' init function returned error.
121201 23:39:09 [Note] Audit Plugin: deinit
121201 23:39:09 [Note] Event Scheduler: Loaded 0 events
121201 23:39:09 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.1.63-0+squeeze1-log' socket: '/var/run/mysqld/mysqld.sock' port: 3306 (Debian)
I have read about setting the offsets manually, if that's what I need to do, what are the offset values and how do I set them?
Thanks.
David
I am trying to get the plugin to work on Percona Server 5.1.65.
I manually created offsets and have succeeded in getting the plugin to initialize. However, I can not for the life of me get the json file option to work.
Here is my my.cnf configuration:
plugin-load=AUDIT=libaudit_plugin.so
audit_validate_checksum = OFF
audit_offsets = 6800, 6864, 4000, 4288, 88, 2072
audit_json_file
audit_json_log_file = /opt/mimysql/cluster1/log/audit.log
audit_record_cmds = insert,update,delete,select
Here is what comes up:
mysql> show global variables like 'audit%';
+---------------------------------+----------------------------------+
| Variable_name | Value |
+---------------------------------+----------------------------------+
| audit_checksum | |
| audit_delay_cmds | |
| audit_delay_ms | 0 |
| audit_json_file | OFF |
| audit_json_file_flush | OFF |
| audit_json_file_sync | 0 |
| audit_json_log_file | mysql-audit.json |
| audit_json_socket | OFF |
| audit_json_socket_name | /tmp/mysql-audit.json.sock |
| audit_offsets | 6800, 6864, 4000, 4288, 88, 2072 |
| audit_offsets_by_version | ON |
| audit_record_cmds | insert,update,delete,select |
| audit_record_objs | |
| audit_uninstall_plugin | OFF |
| audit_validate_checksum | OFF |
| audit_validate_offsets_extended | ON |
+---------------------------------+----------------------------------+
16 rows in set (0.00 sec)
mysql>
Any help would be appreciated :)
thanks,
Keith
Hi,
Percona server crashing with audit plugin when querying from workbench.
Problem is only with "Select * from table" queries other queries are running fine.
MySQL server is on CentOS and Workbench on Windows7.
Logs and versions are given below:
MySQL Error Log:
06:02:50 UTC - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.
key_buffer_size=1073741824
read_buffer_size=4194304
max_used_connections=3
max_threads=140
thread_count=1
connection_count=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 2197169 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Thread pointer: 0x5bea840
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 5912b0d8 thread_stack 0x40000
/usr/sbin/mysqld(my_print_stacktrace+0x35)[0x7a2ef5]
/usr/sbin/mysqld(handle_fatal_signal+0x4a4)[0x67e8b4]
/lib64/libpthread.so.0[0x2aaaaacd6b10]
/usr/lib64/mysql/plugin/libaudit_plugin.so[0x2aaafc12cea5]
/usr/lib64/mysql/plugin/libaudit_plugin.so[0x2aaafc12c396]
/usr/lib64/mysql/plugin/libaudit_plugin.so[0x2aaafc12c174]
/usr/lib64/mysql/plugin/libaudit_plugin.so[0x2aaafc12c1ce]
/usr/lib64/mysql/plugin/libaudit_plugin.so[0x2aaafc127f5c]
/usr/lib64/mysql/plugin/libaudit_plugin.so[0x2aaafc128680]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x1fb)[0x5894cb]
/usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0xd7)[0x622ab7]
/usr/sbin/mysqld(handle_one_connection+0x51)[0x622bf1]
/lib64/libpthread.so.0[0x2aaaaacce73d]
/lib64/libc.so.6(clone+0x6d)[0x2aaaaba81d1d]
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0): is an invalid pointer
Connection ID (thread ID): 58
Status: NOT_KILLED
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.
130612 14:02:51 mysqld_safe Number of processes running now: 0
130612 14:02:51 mysqld_safe mysqld restarted
130612 14:02:51 [Note] Flashcache bypass: disabled
130612 14:02:51 [Note] Flashcache setup error is : ioctl failed
my.cnf Configuration for audit plugin:
audit_uninstall_plugin=OFF
plugin-load=AUDIT=libaudit_plugin.so
audit_offsets=6456, 6504, 4064, 4504, 104, 2576
audit_json_file=1
audit_json_log_file=/var/lib/mysql/audit.log
[root@~]# rpm -qa | grep -i percona
Percona-Server-devel-55-5.5.22-rel25.2.237.rhel5
percona-release-0.0-1
Percona-Server-client-55-5.5.22-rel25.2.237.rhel5
Percona-Server-server-55-5.5.22-rel25.2.237.rhel5
percona-xtrabackup-2.0.5-499.rhel5
Percona-Server-shared-55-5.5.22-rel25.2.237.rhel5
Percona-Server-shared-compat-5.5.22-rel25.2.237.rhel5
percona-toolkit-2.1.7-1
[root@~]# cat /etc/*release
CentOS release 5.5 (Final)
mysql-workbench-gpl-5.2.47-win32
Do let me know if you require any other information.
Attempted to install the .so from https://github.com/downloads/mcafee/mysql-audit/audit-plugin-mysql-5.1-1.0.1-320-linux-i386.zip via plugin-load but it will not load.
mysql Ver 14.14 Distrib 5.1.63, for pc-linux-gnu (i686) using readline 5.1
Error Log below:
120627 09:13:11 mysqld_safe mysqld from pid file /var/lib/mysql/idp.imagedesignserver.ca.pid ended
120627 09:13:12 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
120627 9:13:12 [Note] Plugin 'FEDERATED' is disabled.
120627 9:13:12 [Note] Plugin 'InnoDB' is disabled.
120627 9:13:12 [Note] Audit Plugin: Set interface version to: 12841728 (50163)
120627 9:13:12 [Note] Audit Plugin: starting up. Version: 1.0.1, Revision: 320. AUDIT plugin interface version: 50163. MySQL Server version: 5.1.63-cll.
120627 9:13:12 [Note] Audit Plugin: setup_offsets offsets_string (null)
120627 9:13:12 [Note] Audit Plugin: Audit validate checksum enabled. Mysqld /usr/sbin/mysqld
120627 9:13:12 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.1.63-cll
120627 9:13:12 [ERROR] Plugin 'AUDIT' init function returned error.
120627 9:13:12 [Note] Audit Plugin: removing hot patching function: 0x8202800
120627 9:13:12 [Note] Audit Plugin: targetPage: 0x8202000 targetFunction: 0x8202800
120627 9:13:12 [Note] Audit Plugin: removing hot patching function: 0x81fde80
120627 9:13:12 [Note] Audit Plugin: targetPage: 0x81fd000 targetFunction: 0x81fde80
120627 9:13:12 [Note] Audit Plugin: removing hot patching function: 0x82495f0
120627 9:13:12 [Note] Audit Plugin: targetPage: 0x8249000 targetFunction: 0x82495f0
120627 9:13:12 [Note] Audit Plugin: removing hot patching function: 0x8321790
120627 9:13:12 [Note] Audit Plugin: targetPage: 0x8321000 targetFunction: 0x8321790
120627 9:13:12 [Note] Audit Plugin: removing hot patching function: 0x82032b0
120627 9:13:12 [Note] Audit Plugin: targetPage: 0x8203000 targetFunction: 0x82032b0
120627 9:13:12 [Note] Audit Plugin: removing hot patching function: 0x8206060
120627 9:13:12 [Note] Audit Plugin: targetPage: 0x8206000 targetFunction: 0x8206060
120627 9:13:12 [Note] Event Scheduler: Loaded 0 events
120627 9:13:12 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.1.63-cll' socket: '/var/lib/mysql/mysql.sock' port: 3306 MySQL Community Server (GPL)
Hi,
I noticed that the Quit command is not logged for a user connection if it is preceded by show variables command like:
show variables like '%audit%';
MySQL details:
mysql Ver 14.14 Distrib 5.5.12, for Linux (x86_64) using readline 5.1
Server version: 5.5.12-log MySQL Community Server (GPL)
Regards,
Ankit
I have a web application running with jdbc connector. I want to audit the queries coming from mysql console and discard the one coming from web apps. (Suppose the user/host is common in both the cases)
Is there any configuration using which i could achieve the above?
MySQL RPM --> MySQL-server-5.5.29-1.el6.x86_64
OS Detail -->
Linux MySQL 2.6.39-200.24.1.el6uek.x86_64 #1 SMP Sat Jun 23 02:39:07 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux
MY.CNF entries -->
plugin-load=AUDIT=libaudit_plugin.so
audit_validate_checksum=OFF
audit_offsets=6056, 6104, 3808, 4232, 88, 2568
Error Log -->
130104 4:23:20 InnoDB: 1.1.8 started; log sequence number 8567189
130104 4:23:20 [Note] Audit Plugin: starting up. Version: 1.0.3 , Revision: 371 (64bit). AUDIT plugin interface version: 50529. MySQL Server version: 5.5.29-lo
g.
130104 4:23:20 [Note] Audit Plugin: setup_offsets audit_offsets: 6056, 6104, 3808, 4232, 88, 2568 validate_checksum: 0 offsets_by_version: 1
130104 4:23:20 [Note] Audit Plugin: mysqld: /usr/sbin/mysqld (e6429257a30b289806aa793b3445d960)
130104 4:23:20 [Note] Audit Plugin: setup_offsets Audit_formatter::thd_offsets values: 6056 6104 3808 4232 88 2568
130104 4:23:20 [Note] Audit Plugin: extended offsets validate res: MySQL thread id 123456, OS thread handle 0x0, query id 789 aud_tusr
130104 4:23:20 [Note] Audit Plugin: Validation passed. Using offsets from audit_offsets: 6056, 6104, 3808, 4232, 88, 2568
130104 4:23:20 [Note] Audit Plugin: mem func addr: 0x7f63d3ec6ad0 mem start addr: 0x7f63d3ec7000 page size: 4096
130104 4:23:20 [Note] Audit Plugin: hot patching function: 0x5811d0, trampolineFunction: 0x7f63d3ec7000 trampolinePage: 0x7f63d3ec7000
130104 4:23:20 [Note] Audit Plugin: unable to unprotect. Page: 0x7f63d3ec7000, Size: 4096, errno: 13. Using NO EXEC mode.
130104 4:23:20 [Note] Audit Plugin: hot patch for: log_slow_statement (0x5811d0) complete. Audit func: 0x7f63d3ec6620, Trampoline address: 0x7f63d3ec7000 size:
16.
130104 4:23:20 [Note] Audit Plugin: hot patching function: 0x585140, trampolineFunction: 0x7f63d3ec7020 trampolinePage: 0x7f63d3ec7000
130104 4:23:20 [Note] Audit Plugin: hot patch for: mysql_execute_command (0x585140) complete. Audit func: 0x7f63d3ec6430, Trampoline address: 0x7f63d3ec7020 si
ze: 16.
130104 4:23:20 [Note] Audit Plugin: hot patching function: 0x544220, trampolineFunction: 0x7f63d3ec7040 trampolinePage: 0x7f63d3ec7000
130104 4:23:20 [Note] Audit Plugin: hot patch for: acl_authenticate (0x544220) complete. Audit func: 0x7f63d3ec6690, Trampoline address: 0x7f63d3ec7040 size: 14.
130104 4:23:20 [Note] Audit Plugin: hot patching function: 0x558980, trampolineFunction: 0x7f63d3ec7060 trampolinePage: 0x7f63d3ec7000
130104 4:23:20 [Note] Audit Plugin: hot patch for: send_result_to_client (0x558980) complete. Audit func: 0x7f63d3ec6110, Trampoline address: 0x7f63d3ec7060 size: 15.
130104 4:23:20 [Note] Audit Plugin: hot patching function: 0x5809e0, trampolineFunction: 0x7f63d3ec7080 trampolinePage: 0x7f63d3ec7000
130104 4:23:20 [Note] Audit Plugin: hot patch for: check_table_access (0x5809e0) complete. Audit func: 0x7f63d3ec5f80, Trampoline address: 0x7f63d3ec7080 size: 15.
130104 4:23:20 [Note] Audit Plugin: hot patching function: 0x553be0, trampolineFunction: 0x7f63d3ec70a0 trampolinePage: 0x7f63d3ec7000
130104 4:23:20 [Note] Audit Plugin: hot patch for: open_tables (0x553be0) complete. Audit func: 0x7f63d3ec61e0, Trampoline address: 0x7f63d3ec70a0 size: 15.
130104 4:23:20 [Note] Audit Plugin: Init completed successfully.
22:53:20 UTC - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.
key_buffer_size=268435456
read_buffer_size=1048576
max_used_connections=0
max_threads=151
thread_count=0
connection_count=0
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 573116 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Thread pointer: 0x0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0 thread_stack 0x40000
/usr/sbin/mysqld(my_print_stacktrace+0x35)[0x7a6325]
/usr/sbin/mysqld(handle_fatal_signal+0x4a4)[0x67f894]
/lib64/libpthread.so.0(+0xf500)[0x7f63ec03e500]
/usr/sbin/mysqld(_Z19init_update_queriesv+0x0)[0x5812c0]
/usr/sbin/mysqld[0x514dde]
/usr/sbin/mysqld(_Z11mysqld_mainiPPc+0x46d)[0x51832d]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x7f63eb1f3cdd]
/usr/sbin/mysqld[0x50de65]
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.
130104 04:23:20 mysqld_safe mysqld from pid file /var/lib/mysql/MySQL.pid ended
When I try to install mysql-audit 1.0.3 on MySQL 5.5.29 on Centos 5.9 64-bit, I get the following:
Audit Plugin: Set interface version to: 12935424 (50529)
Audit Plugin: starting up. Version: 1.0.3 , Revision: 371 (64bit). AUDIT plugin interface version: 50529. MySQL Server version; 5.5.29.
Audit Plugin: setup_offsets audit_offsets: (null) validate_checksum: 1 offsets_by_version: 1
Audit Plugin: mysqld: /usr/sbin/mysqld (7b0d172c9c671983b62bcd9c3721bf41)
Audit Plugin: Couldn't find proper THD offsets for: 5.5.29
ERROR Plugin 'AUDIT' init function returned error
Audit Plugin: deinit
Could you please advise what I need to do to correct this problem?
Thanks,
Sandra Arnold
Dear All
Are there have any documents to indicate what other command can be audit beside update, delete , insert. I know I can find out a lot in the audit files, but I like to have a formal documents instead of look from a huge audit file.
Thanks
Paul
It would be nice to be able to send logs directly to a syslog server.
If I set audit_delay_cmds in my.cnf, and subsequently try to change it dynamically by using "set global audit_delay_cmds = 'insert,insert_select,update';" for example, I get a big fat stack trace/heap dump
I see this both with a precompiled version and if I compile and install myself, using server 5.1.63 X64 on Linux.
Here's the trace...
mysql> set global audit_delay_cmds = 'insert,insert_select,update';
*** glibc detected *** /usr/sbin/mysqld: free(): invalid pointer: 0x000000000bf2afcb ***
======= Backtrace: =========
/lib64/libc.so.6[0x3b1ec7245f]
/lib64/libc.so.6(cfree+0x4b)[0x3b1ec728bb]
/usr/lib64/mysql/plugin/libaudit_plugin.so[0x2aaaab4e6efe]
/usr/sbin/mysqld(_ZN17sys_var_pluginvar6updateEP3THDP7set_var+0xc6)[0x71df86]
/usr/sbin/mysqld(_ZN7set_var6updateEP3THD+0x45)[0x5e4a15]
/usr/sbin/mysqld(_Z17sql_set_variablesP3THDP4ListI12set_var_baseE+0x69)[0x5e46f9]
/usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x8eb)[0x5d843b]
/usr/lib64/mysql/plugin/libaudit_plugin.so[0x2aaaab4e63d5]
/usr/sbin/mysqld(_Z11mysql_parseP3THDPcjPPKc+0x1f3)[0x5dde53]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x53a)[0x5de46a]
/usr/sbin/mysqld(_Z10do_commandP3THD+0xde)[0x5df5ae]
/usr/sbin/mysqld(handle_one_connection+0x661)[0x5d2331]
/lib64/libpthread.so.0[0x3b1f40673d]
/lib64/libc.so.6(clone+0x6d)[0x3b1ecd44bd]
======= Memory map: ========
00400000-005d1000 r-xp 00000000 fd:00 14972165 /usr/sbin/mysqld
005d1000-005d2000 r-xp 001d1000 fd:00 14972165 /usr/sbin/mysqld
005d2000-005d3000 r-xp 001d2000 fd:00 14972165 /usr/sbin/mysqld
005d3000-005d5000 r-xp 001d3000 fd:00 14972165 /usr/sbin/mysqld
005d5000-005d7000 r-xp 001d5000 fd:00 14972165 /usr/sbin/mysqld
005d7000-005d8000 r-xp 001d7000 fd:00 14972165 /usr/sbin/mysqld
005d8000-00616000 r-xp 001d8000 fd:00 14972165 /usr/sbin/mysqld
00616000-00617000 r-xp 00216000 fd:00 14972165 /usr/sbin/mysqld
00617000-006dd000 r-xp 00217000 fd:00 14972165 /usr/sbin/mysqld
006dd000-006de000 r-xp 002dd000 fd:00 14972165 /usr/sbin/mysqld
006de000-00a57000 r-xp 002de000 fd:00 14972165 /usr/sbin/mysqld
00b56000-00c8a000 rw-p 00656000 fd:00 14972165 /usr/sbin/mysqld
00c8a000-00ca3000 rw-p 00c8a000 00:00 0
0bf24000-0c5aa000 rw-p 0bf24000 00:00 0 [heap]
407d1000-407d2000 ---p 407d1000 00:00 0
407d2000-411d2000 rw-p 407d2000 00:00 0
411d2000-411d3000 ---p 411d2000 00:00 0
411d3000-41213000 rw-p 411d3000 00:00 0
4185a000-4185b000 ---p 4185a000 00:00 0
4185b000-4189b000 rw-p 4185b000 00:00 0
4192c000-4192d000 ---p 4192c000 00:00 0
4192d000-4232d000 rw-p 4192d000 00:00 0
4232d000-4232e000 ---p 4232d000 00:00 0
4232e000-42d2e000 rw-p 4232e000 00:00 0
42d2e000-42d2f000 ---p 42d2e000 00:00 0
42d2f000-4372f000 rw-p 42d2f000 00:00 0
4372f000-43730000 ---p 4372f000 00:00 0
43730000-44130000 rw-p 43730000 00:00 0
44130000-44131000 ---p 44130000 00:00 0
44131000-44b31000 rw-p 44131000 00:00 0
44b31000-44b32000 ---p 44b31000 00:00 0
44b32000-45532000 rw-p 44b32000 00:00 0
45532000-45533000 ---p 45532000 00:00 0
45533000-45f33000 rw-p 45533000 00:00 0
45f33000-45f34000 ---p 45f33000 00:00 0
45f34000-46934000 rw-p 45f34000 00:00 0
3b1e800000-3b1e81c000 r-xp 00000000 fd:00 9395256 /lib64/ld-2.5.so
3b1ea1c000-3b1ea1d000 r--p 0001c000 fd:00 9395256 /lib64/ld-2.5.so
3b1ea1d000-3b1ea1e000 rw-p 0001d000 fd:00 9395256 /lib64/ld-2.5.so
3b1ec00000-3b1ed4e000 r-xp 00000000 fd:00 9395257 /lib64/libc-2.5.so
3b1ed4e000-3b1ef4e000 ---p 0014e000 fd:00 9395257 /lib64/libc-2.5.so
3b1ef4e000-3b1ef52000 r--p 0014e000 fd:00 9395257 /lib64/libc-2.5.so
3b1ef52000-3b1ef53000 rw-p 00152000 fd:00 9395257 /lib64/libc-2.5.so
3b1ef53000-3b1ef58000 rw-p 3b1ef53000 00:00 0
3b1f000000-3b1f002000 r-xp 00000000 fd:00 9395258 /lib64/libdl-2.5.so
3b1f002000-3b1f202000 ---p 00002000 fd:00 9395258 /lib64/libdl-2.5.so
3b1f202000-3b1f203000 r--p 00002000 fd:00 9395258 /lib64/libdl-2.5.so
3b1f203000-3b1f204000 rw-p 00003000 fd:00 9395258 /lib64/libdl-2.5.so
3b1f400000-3b1f416000 r-xp 00000000 fd:00 9395259 /lib64/libpthread-2.5.so
3b1f416000-3b1f615000 ---p 00016000 fd:00 9395259 /lib64/libpthread-2.5.so
3b1f615000-3b1f616000 r--p 00015000 fd:00 9395259 /lib64/libpthread-2.5.so
3b1f616000-3b1f617000 rw-p 00016000 fd:00 9395259 /lib64/libpthread-2.5.so
3b1f617000-3b1f61b000 rw-p 3b1f617000 00:00 0
3b1f800000-3b1f882000 r-xp 00000000 fd:00 9395508 /lib64/libm-2.5.so
3b1f882000-3b1fa81000 ---p 00082000 fd:00 9395508 /lib64/libm-2.5.so
3b1fa81000-3b1fa82000 r--p 00081000 fd:00 9395508 /lib64/libm-2.5.so
3b1fa82000-3b1fa83000 rw-p 00082000 fd:00 9395508 /lib64/libm-2.5.so
3b22000000-3b22015000 r-xp 00000000 fd:00 9395543 /lib64/libnsl-2.5.so
3b22015000-3b22214000 ---p 00015000 fd:00 9395543 /lib64/libnsl-2.5.so
3b22214000-3b22215000 r--p 00014000 fd:00 9395543 /lib64/libnsl-2.5.so
3b22215000-3b22216000 rw-p 00015000 fd:00 9395543 /lib64/libnsl-2.5.so
3b22216000-3b22218000 rw-p 3b22216000 00:00 0
3b2fe00000-3b2fe09000 r-xp 00000000 fd:00 9395548 /lib64/libcrypt-2.5.so
3b2fe09000-3b30008000 ---p 00009000 fd:00 9395548 /lib64/libcrypt-2.5.so
3b30008000-3b30009000 r--p 00008000 fd:00 9395548 /lib64/libcrypt-2.5.so
3b30009000-3b3000a000 rw-p 00009000 fd:00 9395548 /lib64/libcrypt-2.5.so
3b3000a000-3b30038000 rw-p 3b3000a000 00:00 0
3eee800000-3eee80d000 r-xp 00000000 fd:00 9395241 /lib64/libgcc_s-4.1.2-20080825.so.1
3eee80d000-3eeea0d000 ---p 0000d000 fd:00 9395241 /lib64/libgcc_s-4.1.2-20080825.so.1
3eeea0d000-3eeea0e000 rw-p 0000d000 fd:00 9395241 /lib64/libgcc_s-4.1.2-20080825.so.1
2aaaaaace000-2aaaaaad8000 r-xp 00000000 fd:00 9395267 /lib64/libnss_files-2.5.so
2aaaaaad8000-2aaaaacd7000 ---p 0000a000 fd:00 9395267 /lib64/libnss_files-2.5.so
2aaaaacd7000-2aaaaacd8000 r--p 00009000 fd:00 9395267 /lib64/libnss_files-2.5.so
2aaaaacd8000-2aaaaacd9000 rw-p 0000a000 fd:00 9395267 /lib64/libnss_files-2.5.so
2aaaaacd9000-2aaaab4da000 rw-p 2aaaaacd9000 00:00 0
2aaaab4da000-2aaaab4e5000 r-xp 00000000 fd:00 15877585 /usr/lib64/mysql/plugin/libaudit_plugin.so
2aaaab4e5000-2aaaab4e6000 r-xp 0000b000 fd:00 15877585 /usr/lib64/mysql/plugin/libaudit_plugin.so
2aaaab4e6000-2aaaab4f5000 r-xp 0000c000 fd:00 15877585 /usr/lib64/mysql/plugin/libaudit_plugin.so
2aaaab4f5000-2aaaab5f4000 ---p 0001b000 fd:00 15877585 /usr/lib64/mysql/plugin/libaudit_plugin.so
2aaaab5f4000-2aaaab60e000 rw-p 0001a000 fd:00 15877585 /usr/lib64/mysql/plugin/libaudit_plugin.so
2aaaab60e000-2aaaac291000 rw-p 2aaaab60e000 00:00 0
2aaaac4b4000-2aaaac6ba000 rw-p 2aaaac4b4000 00:00 0
2aef6780d000-2aef67810000 r-xp 2aef6780d000 00:00 0 [vdso]
2aef67810000-2aef67812000 rw-p 2aef67810000 00:00 0
2aef67822000-2aef67825000 rw-p 2aef67822000 00:00 0
7fffc3dea000-7fffc3dff000 rw-p 7ffffffe9000 00:00 0 [stack]
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vsyscall]
ERROR 2013 (HY000): Lost connection to MySQL server during query
my.cnf:
...
plugin-load=AUDIT=libaudit_plugin.so
audit_validate_checksum=OFF
...
mysql error.log when starting up:
120419 13:40:57 [Note] Audit Plugin: starting up. Version: 1.0.1, Revision: 320. AUDIT plugin interface version: 50517. MySQL Server version: 5.5.17-0
ubuntu1lucid1ppa3.
120419 13:40:57 [Note] Audit Plugin: setup_offsets offsets_string (null)
120419 13:40:57 [ERROR] Audit Plugin: Offsets version: 5.5.17 match server version: 5.5.17-0ubuntu1lucid1ppa3 but thread id check fails with value:
0. Skipping offest.
120419 13:40:57 [ERROR] Audit Plugin: Offsets version: 5.5.17 match server version: 5.5.17-0ubuntu1lucid1ppa3 but thread id check fails with value:
0. Skipping offest.
120419 13:40:57 [Note] Audit Plugin: Couldn't find proper THD offsets for: 5.5.17-0ubuntu1lucid1ppa3
120419 13:40:57 [ERROR] Plugin 'AUDIT' init function returned error.
120419 13:40:57 [Note] Audit Plugin: removing hot patching function: 0x8688d50
120419 13:40:57 [Note] Audit Plugin: targetPage: 0x8688000 targetFunction: 0x8688d50
120419 13:40:57 [Note] Audit Plugin: removing hot patching function: 0x8641ff0
120419 13:40:57 [Note] Audit Plugin: targetPage: 0x8641000 targetFunction: 0x8641ff0
120419 13:40:57 [Note] Audit Plugin: removing hot patching function: 0x8653090
120419 13:40:57 [Note] Audit Plugin: targetPage: 0x8653000 targetFunction: 0x8653090
120419 13:40:57 [Note] Audit Plugin: removing hot patching function: 0x865a210
120419 13:40:57 [Note] Audit Plugin: targetPage: 0x865a000 targetFunction: 0x865a210
120419 13:40:57 [Note] Audit Plugin: removing hot patching function: 0x8688a50
120419 13:40:57 [Note] Audit Plugin: targetPage: 0x8688000 targetFunction: 0x8688a50
120419 13:40:57 [Note] Audit Plugin: removing hot patching function: 0x868da40
120419 13:40:57 [Note] Audit Plugin: targetPage: 0x868d000 targetFunction: 0x868da40
120419 13:40:57 [Note] Event Scheduler: Loaded 0 events
120419 13:40:57 [Note] /usr/sbin/mysqld: ready for connections.
Hi,
was compiling from source this morning,
cd mysql-5.5.29
cmake .
make
cd ..
bash bootstrap.sh
CXX='gcc -static-libgcc' CC='gcc -static-libgcc' ./configure --with-mysql=mysql-5.5.29 --with-mysql-libservices=mysql-5.5.29/libservices/libmysqlservices.a
make
This fails for me with:
command line option '-Wimplicit' is valid for C/ObjC but not for C++
I edited ./configure by hand and removed -Wimplicit around line 15750:
CPPFLAGS="$CPPFLAGS -Werror"
after this:
make clean
CXX='gcc -static-libgcc' CC='gcc -static-libgcc' ./configure --with-mysql=mysql-5.5.29 --with-mysql-libservices=mysql-5.5.29/libservices/libmysqlservices.a
make
And the system works fine. I wonder if this is a problem with my autotools or in mysql-audit in general? I could also try using g++ instead of gcc on the CXX= line. Any thoughts?
PS. There is no mention in compiling.txt that you actually need to run bootstrap.sh also with 5.5.29.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.
