If a connection is aborted prior to authentication, then a warning is only logged if log_warnings=4 is set, and the warning is the same "Aborted connection ... (CLOSE_CONNECTION)" warning as it is for any other connection.
You can reproduce this by setting log_warnings=4:
And then something like using telnet to connect to the MariaDB port, and then killing the telnet process:
At that point, the error log will contain a message like this:
I think this message should actually read something like this:
I also think that this message should be logged when log_warnings=2, instead of log_warnings=4.
I also think that
MDEV-19277 should be implemented as part of this.