Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
None
-
None
-
RHEL 6.5, MariaDB 5.5.32, x86_64, server_audit-1.1.3
Description
audit log will not rotate when the file size exceeds global variable setting
Setting server_audit_file_rotate_now = ON does work though.
To reproduce, try setting server_audit_events = 'connect' and server_audit_file_rotate_size = 1000. Then connect with a bad password about 20 times:
for i in {1..20}; do mysql -ufail -pfail; done
|
Notice that the server_audit.log file does not rotate even though its size is 2700 bytes when the rotate size is 1000 bytes.
Same can be said about 2 more variables:
server_audit_file_rotations
server_audit_syslog_ident
We should fix them alltogether.
After stepping through the debugger, the "bug" is that the server_audit_file_rotate_size will not take effect until after the log is closed and opened which can be achieved by:
set global server_audit_logging=OFF;
set global server_audit_logging=ON;
So this can provide a work around. In other words, after changing the server_audit_file_rotate_size, set logging off and then back on for the size to take effect.
Probably the best approach is to update this line in server_audit.c
static MYSQL_SYSVAR_ULONGLONG(file_rotate_size, file_rotate_size,PLUGIN_VAR_RQCMDARG, "Maximum size of the log to start the rotation.",NULL, NULL,1000000, 100, ((long long) 0x7FFFFFFFFFFFFFFFLL), 1);and set the second NULL to a function that updates the global variable logfile in server_audit.c setting logfile->sizelimit = file_rotate_size