Functional Issue: Quit command not logged following a command sequence

[trellix-enterprise]

Functional Issue: Quit command not logged following a command sequence

[glicht]

Hi Ankit,

Thanks for reporting this. Can you specify what distribution of MySQL
exactly are you using. Is this the official release from mysql.com?

Also, are you sure that the Quit command is being logged in other scenarios
(for example after a select or update)?

On Tue, Jan 8, 2013 at 11:47 AM, ankitthakwani [email protected]:

show variables like '%audit%';

[ankitthakwani]

Hi Guy,

The MySQL Status says:

mysql> status

mysql Ver 14.14 Distrib 5.5.12, for Linux (x86_64) using readline 5.1

Connection id: 270761
Current database:
Current user: root@localhost
SSL: Not in use
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.5.12-log MySQL Community Server (GPL)
Protocol version: 10
Connection: Localhost via UNIX socket
Server characterset: utf8
Db characterset: utf8
Client characterset: utf8
Conn. characterset: utf8
UNIX socket: /var/lib/mysql/mysql.sock
Uptime: 127 days 18 hours 55 min 21 sec

[ankit@reldb ~]$ rpm -qa | grep -i mysql
MySQL-devel-5.5.12-1.linux2.6.x86_64
MySQL-server-5.5.12-1.linux2.6.x86_64
MySQL-shared-5.5.12-1.linux2.6.x86_64
MySQL-client-5.5.12-1.linux2.6.x86_64

This was downloaded and Installed when I was not working in my current company, but I have talked to my colleagues and they confirm that it was installed from mysql.com.

Yes, the Quit command is logged in other scenarios.

Regards,
Ankit

[glicht]

Can you include the json audit log file after reproducing the issue, then login again and do a "select" and see that the quit command is shown. I would like to examine the full flow in the json file once for failure to show quit and once with the quit.

thanks,

Guy

[ankitthakwani]

Session Details:

[root@MySQL-Master ~]# mysql -u root -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 12
Server version: 5.5.12-log MySQL Community Server (GPL)

Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> select connection_id();
+-----------------+
| connection_id() |
+-----------------+
| 12 |
+-----------------+
1 row in set (0.03 sec)

mysql> show variables like '%audit%';
+---------------------------------+---------------------------------+
| Variable_name | Value |
+---------------------------------+---------------------------------+
| audit_checksum | |
| audit_delay_cmds | |
| audit_delay_ms | 0 |
| audit_json_file | ON |
| audit_json_file_flush | OFF |
| audit_json_file_sync | 0 |
| audit_json_log_file | /var/lib/mysql/audit.log |
| audit_json_socket | OFF |
| audit_json_socket_name | /var/lib/mysql/mysql-audit.sock |
| audit_offsets | |
| audit_offsets_by_version | ON |
| audit_record_cmds | |
| audit_record_objs | sakila.,mysql.,{} |
| audit_uninstall_plugin | OFF |
| audit_validate_checksum | ON |
| audit_validate_offsets_extended | ON |
| audit_whitelist_users | |
+---------------------------------+---------------------------------+
17 rows in set (0.01 sec)

mysql> exit;
Bye
[root@MySQL-Master ~]# mysql -u root -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 13
Server version: 5.5.12-log MySQL Community Server (GPL)

Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> select connection_id();
+-----------------+
| connection_id() |
+-----------------+
| 13 |
+-----------------+
1 row in set (0.01 sec)

mysql> exit
Bye
[root@MySQL-Master ~]#

Audit Log

{"msg-type":"activity","date":"1357727713465","thread-id":"12","query-id":"0","user":"root","priv_user":"root","host":"localhost","cmd":"Connect","query":"Connect"}
{"msg-type":"activity","date":"1357727713466","thread-id":"12","query-id":"70","user":"root","priv_user":"root","host":"localhost","cmd":"select","query":"select @@version_comment limit 1"}
{"msg-type":"activity","date":"1357727721650","thread-id":"12","query-id":"71","user":"root","priv_user":"root","host":"localhost","cmd":"select","query":"select connection_id()"}
{"msg-type":"activity","date":"1357727747264","thread-id":"13","query-id":"0","user":"root","priv_user":"root","host":"localhost","cmd":"Connect","query":"Connect"}
{"msg-type":"activity","date":"1357727747265","thread-id":"13","query-id":"74","user":"root","priv_user":"root","host":"localhost","cmd":"select","query":"select @@version_comment limit 1"}
{"msg-type":"activity","date":"1357727756320","thread-id":"13","query-id":"75","user":"root","priv_user":"root","host":"localhost","cmd":"select","query":"select connection_id()"}
{"msg-type":"activity","date":"1357727757948","thread-id":"13","query-id":"76","user":"root","priv_user":"root","host":"localhost","cmd":"Quit","query":"Quit"}

[glicht]

Latest commit should resolve this issue.

[ankitthakwani]

Working fine now !