Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.1.1, 5.5(EOL), 10.0(EOL)
Description
Hey,
the audit plugin "should" record every part of the query. the current implementation is using a static buffer to shorten the query part. since an audit is used to detect problems or hacking attempts, the audit plugin is unusable. the current size of the buffer is 768 and should be dynamic by default or atleast configurable.
especially on hacking attacks the last part (where clause) is modified but this part is not part of the audit line. in addition this should be added to the documentation.
https://github.com/MariaDB/server/blob/10.1/plugin/server_audit/server_audit.c#L1018
Attachments
Activity
| Field | Original Value | New Value |
|---|---|---|
| Fix Version/s | 10.0 [ 16000 ] | |
| Fix Version/s | 5.5 [ 15800 ] | |
| Affects Version/s | 10.0 [ 16000 ] | |
| Affects Version/s | 5.5 [ 15800 ] | |
| Assignee | Alexey Botchkov [ holyfoot ] | |
| Labels | plugins | server_audit |
Any progress on that issue? Would be cool to know if there will be a change on future releases.
| Status | Open [ 1 ] | In Progress [ 3 ] |
Fixing patch: http://lists.askmonty.org/pipermail/commits/2015-March/007689.html
The server_audit_query_log_limit variable added to control the length of the log record.
| Fix Version/s | 5.5.43 [ 18601 ] | |
| Fix Version/s | 5.5 [ 15800 ] | |
| Fix Version/s | 10.0 [ 16000 ] | |
| Resolution | Fixed [ 1 ] | |
| Status | In Progress [ 3 ] | Closed [ 6 ] |
| Workflow | MariaDB v2 [ 59702 ] | MariaDB v3 [ 62413 ] |
| Workflow | MariaDB v3 [ 62413 ] | MariaDB v4 [ 148812 ] |
holyfoot,
I remember it being discussed back in days and declared to be by design, but I cannot find any traces of it in JIRA, so maybe I'm wrong. Could you please clarify?