Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-11510

Audit plugin sometimes causes server to crash when using with MySQL

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 10.1.19
    • Fix Version/s: 5.5.54
    • Component/s: Plugin - Audit
    • Labels:
      None

      Description

      The MariaDB audit plugin that's included in 10.1.19 (and probably also the recent 5.5 and 10.0 releases) can sometimes cause the server to crash when used with MySQL.

      I have seen the following backtrace with MySQL 5.6.30:

      03:27:40 UTC - mysqld got signal 11 ;
      This could be because you hit a bug. It is also possible that this binary
      or one of the libraries it was linked against is corrupt, improperly built,
      or misconfigured. This error can also be caused by malfunctioning hardware.
      We will try our best to scrape up some info that will hopefully help
      diagnose the problem, but since we have already crashed,
      something is definitely wrong and this may fail.
       
      key_buffer_size=8388608
      read_buffer_size=131072
      max_used_connections=1
      max_threads=151
      thread_count=1
      connection_count=1
      It is possible that mysqld could use up to
      key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 68108 K  bytes of memory
      Hope that's ok; if not, decrease some variables in the equation.
       
      Thread pointer: 0x20c9530
      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 7efd6c423e90 thread_stack 0x40000
      /usr/sbin/mysqld(my_print_stacktrace+0x3b)[0x8e504b]
      /usr/sbin/mysqld(handle_fatal_signal+0x491)[0x674761]
      /lib64/libpthread.so.0(+0xf100)[0x7efd80cae100]
      /usr/lib64/mysql/plugin/server_audit.so(auditing+0x4f4)[0x7efd7a590324]
      /usr/sbin/mysqld[0x6a3105]
      /usr/sbin/mysqld(_Z18mysql_audit_notifyP3THDjjz+0xba)[0x6a32fa]
      /usr/sbin/mysqld[0x65db3c]
      /usr/sbin/mysqld(_ZN6LOGGER11log_commandEP3THD19enum_server_commandPKcm+0x36)[0x661846]
      /usr/sbin/mysqld(_Z17general_log_printP3THD19enum_server_commandPKcz+0x8b)[0x66193b]
      /usr/sbin/mysqld(_Z16acl_authenticateP3THDj+0x2d3)[0x699ac3]
      /usr/sbin/mysqld[0x6c34e3]
      /usr/sbin/mysqld(_Z16login_connectionP3THD+0x3e)[0x6c441e]
      /usr/sbin/mysqld(_Z22thd_prepare_connectionP3THD+0x24)[0x6c4a14]
      /usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x12c)[0x6c4d2c]
      /usr/sbin/mysqld(handle_one_connection+0x40)[0x6c4e10]
      /usr/sbin/mysqld(pfs_spawn_thread+0x143)[0xb39433]
      /lib64/libpthread.so.0(+0x7dc5)[0x7efd80ca6dc5]
      /lib64/libc.so.6(clone+0x6d)[0x7efd7f96a1cd]
      

      Another user reported the following backtrace on 5.7.15:

      Thread pointer: 0x7f2624000fa0
      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong…
      stack_bottom = 7f263c4f5ea8 thread_stack 0x40000
      /usr/local/mysql/bin/mysqld(my_print_stacktrace+0x35)[0xf1e045]
      /usr/local/mysql/bin/mysqld(handle_fatal_signal+0x4a4)[0x79d404]
      /lib64/libpthread.so.0(+0xf100)[0x7f266085d100]
      /usr/local/mysql/lib/plugin/server_audit.so(auditing+0x4f4)[0x7f264409c324]
      /usr/local/mysql/lib/plugin/server_audit.so(+0x940d)[0x7f264409f40d]
      /usr/local/mysql/bin/mysqld(_Z18mysql_audit_notifyP3THD30mysql_event_general_subclass_tiPKcm+0x262)[0x79e032]
      /usr/local/mysql/bin/mysqld(_ZN12Query_logger17general_log_printEP3THD19enum_server_commandPKcz+0xad)[0xc4267d]
      /usr/local/mysql/bin/mysqld(_Z15acl_log_connectPKcS0_S0_S0_P3THD19enum_server_command+0xa5)[0x7a3e95]
      /usr/local/mysql/bin/mysqld(_Z16acl_authenticateP3THD19enum_server_command+0xaa1)[0x7a5ec1]
      /usr/local/mysql/bin/mysqld[0xcb8475]
      /usr/local/mysql/bin/mysqld(_Z22thd_prepare_connectionP3THD+0x5e)[0xcb88de]
      /usr/local/mysql/bin/mysqld(handle_connection+0x279)[0xdc5a39]
      /usr/local/mysql/bin/mysqld(pfs_spawn_thread+0x174)[0x11d6ae4]
      /lib64/libpthread.so.0(+0x7dc5)[0x7f2660855dc5]
      /lib64/libc.so.6(clone+0x6d)[0x7f265f51dced]
       
      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0): is an invalid pointer
      Connection ID (thread ID): 4
      Status: NOT_KILLED
      

      The plugin was installed in the following way:

      Download the MariaDB tarball and put the plugin in the proper location:

      $ wget https://downloads.mariadb.org/interstitial/mariadb-10.1.19/bintar-linux-x86_64/mariadb-10.1.19-linux-x86_64.tar.gz
      $ tar -xzf mariadb-10.1.19-linux-x86_64.tar.gz
      $ ls -l mariadb-10.1.19-linux-x86_64/lib/plugin/ | grep "audit"
      -rwxr-xr-x 1 ec2-user ec2-user 176024 Nov 4 09:37 server_audit.so
      $ sudo install mariadb-10.1.19-linux-x86_64/lib/plugin/server_audit.so /usr/lib64/mysql/plugin/
      

      Then install the plugin in MySQL:

      INSTALL PLUGIN server_audit SONAME 'server_audit.so';
      

      Then enable it in the configuration file:

      server_audit_logging=ON
      server_audit_events=connect,query,table,query_ddl,query_dml,query_dcl
      server_audit_excl_users=root
      

      And restart the server:

      sudo systemctl restart mysqld
      

        Attachments

          Activity

            People

            • Assignee:
              holyfoot Alexey Botchkov
              Reporter:
              GeoffMontee Geoff Montee
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: