Details
-
Bug
-
Status: Stalled (View Workflow)
-
Critical
-
Resolution: Unresolved
-
None
-
None
-
Q4/2025 Galera Maintenance
Description
We have the audit log enabled on a Galera cluster. Queries are ran on the primary node by a user, and successfully applied to the other nodes.
The audit log on the primary node is correct, and shows the `DROP`, `CREATE`, and `QUERY` events.
However, on the other cluster nodes, the audit log only shows the `DROP` and `CREATE` events, and strips out the user.
Here are some log lines from the primary node:
20241024 04:33:08,dbclu02,admin,%,607651293,2630777699,DROP,DB_Staging,AD_Users,
|
20241024 04:33:08,dbclu02,admin,%,607651293,2630777699,QUERY,DB_Staging,'DROP TABLE IF EXISTS `AD_Users`',0
|
20241024 04:33:08,dbclu02,admin,%,607651293,2630777704,CREATE,DB_Staging,AD_Users,
|
20241024 04:33:08,dbclu02,admin,%,607651293,2630777704,QUERY,DB_Staging,'CREATE TABLE `AD_Users` ... (redacted)
|
The replica nodes only shows the `DROP` and `CREATE` entries:
20241024 04:33:08,dbclu01,,,7,492001376,DROP,DB_Staging,AD_Users,
|
20241024 04:33:08,dbclu01,,,13,492001381,CREATE,DB_Staging,AD_Users,
|
This is confusing as it is unclear where these events came from when looking at the replica nodes. At a minimum, we should add some kind of "system user" to the log so it doesn't raise any concerns.