Details
-
Bug
-
Status: Closed (View Workflow)
-
Minor
-
Resolution: Fixed
-
None
-
None
-
None
Description
I keep default values for rotation parameters:
| server_audit_rotate | OFF |
|
| server_audit_rotations | 9 |
|
But the logs are still rotated at ~1000000 bytes:
-rw-rw---- 1 elenst elenst 263536 Jul 5 20:24 my_audit.log
|
-rw-rw---- 1 elenst elenst 1000190 Jul 5 20:23 my_audit.log.1
|
-rw-rw---- 1 elenst elenst 1000011 Jul 5 20:23 my_audit.log.2
|
-rw-rw---- 1 elenst elenst 1000013 Jul 5 20:23 my_audit.log.3
|
-rw-rw---- 1 elenst elenst 1000081 Jul 5 20:22 my_audit.log.4
|
-rw-rw---- 1 elenst elenst 1000022 Jul 5 20:22 my_audit.log.5
|
-rw-rw---- 1 elenst elenst 1000252 Jul 5 20:22 my_audit.log.6
|
-rw-rw---- 1 elenst elenst 1000162 Jul 5 20:21 my_audit.log.7
|
-rw-rw---- 1 elenst elenst 1000146 Jul 5 20:21 my_audit.log.8
|
-rw-rw---- 1 elenst elenst 1000016 Jul 5 20:21 my_audit.log.9
|
To my knowledge, I don't do anything to provoke this.
bzr version-info
revision-id: holyfoot@askmonty.org-20130704123621-gb3jvhyxdax6gpm9
|
revno: 3825
|
branch-nick: 5.5-noga-hf
|
Attachments
Issue Links
- relates to
-
MDEV-4472 Auditing Plugin
-
- Closed
-
Activity
>> Should it be done in more apparent way?
I think it should.
If you mean rotating at this exact moment, I'd expect FLUSH LOGS to do the trick (maybe we need FLUSH AUDIT LOGS or something).
In any case, there should be a way to turn off automatic log rotation, server_audit_rotate looks like the only viable candidate, and currently the value OFF is deceptive - I'm sure I have rotation turned off, and later I find out that my audit 
logs have been overridden due to the rotation algorithm which I didn't even set.
I suggest to keep it open for now and to check with whoever-makes-decisions-about-the-design.
What about renaming variables, to make them more consistent and self-documenting?
server_audit_file_path -> server_audit_file_path (no changes)
server_audit_file_rotate_size -> server_audit_file_rotate_size (no changes)
server_audit_rotations -> server_audit_file_rotations
server_audit_rotate -> server_audit_file_rotate_now or server_audit_file_flush with the variable being STRING (not BOOL) and the default value being empty string.
Variables renamed:
server_audit_rotations -> server_audit_file_rotations
server_audit_rotate -> server_audit_file_rotate_now with the variable being STRING (not BOOL)
It's not a bug.
The very 'server_audit_rotate' variable was made to let user to force log rotations by assigning any value to it.
Should it be done in more apparent way?