Details
-
Task
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.2.0-1, 10.2.0-2
Description
example:
150716 13:17:27 [Note] /usr/sbin/mysqld: Normal shutdown
|
.
|
..
|
150716 13:17:28 [Note] /usr/sbin/mysqld: Shutdown complete
|
Should be
150716 13:17:27 [Note] /usr/sbin/mysqld: Normal shutdown initiated by root at localhost
|
.
|
..
|
150716 13:17:28 [Note] /usr/sbin/mysqld: Shutdown initiated by root at localhost complete
|
Attachments
Issue Links
- relates to
-
MDEV-9592 New 'Normal shutdown' log format can be confusing
-
- Closed
-
-
-
- Open
-
- links to
Activity
I don't ask for the impossible .. 
But the shutdown command seems to be omitted by the audit plugin. So from the security auditing point of view, it will be a good addition/feature of MariaDB.
my bad, in fact the MariaDB SHUTDOWN command is logged via the audit plugin , but the mysqladmin SHUTDOWN command is not logged :
5.5.44-MariaDB-log :
mysql root@darkstar:[Fri Jul 17 14:10:01 2015][(none)]> INSTALL PLUGIN SERVER_AUDIT SONAME 'server_audit.so';
|
Query OK, 0 rows affected (0.06 sec)
|
|
|
mysql root@darkstar:[Fri Jul 17 14:10:12 2015][(none)]> set global server_audit_logging = 1;
|
Query OK, 0 rows affected (0.01 sec)
|
mysql root@darkstar:[Fri Jul 17 14:12:58 2015][(none)]> show global variables like '%audit%';
|
+-------------------------------+-----------------------+
|
| Variable_name | Value |
|
+-------------------------------+-----------------------+
|
| server_audit_events | |
|
| server_audit_excl_users | |
|
| server_audit_file_path | server_audit.log |
|
| server_audit_file_rotate_now | OFF |
|
| server_audit_file_rotate_size | 1000000 |
|
| server_audit_file_rotations | 9 |
|
| server_audit_incl_users | |
|
| server_audit_logging | ON |
|
| server_audit_mode | 0 |
|
| server_audit_output_type | file |
|
| server_audit_query_log_limit | 1024 |
|
| server_audit_syslog_facility | LOG_USER |
|
| server_audit_syslog_ident | mysql-server_auditing |
|
| server_audit_syslog_info | |
|
| server_audit_syslog_priority | LOG_INFO |
|
+-------------------------------+-----------------------+
|
15 rows in set (0.00 sec)
|
|
|
mysql root@darkstar:[Fri Jul 17 14:13:01 2015][(none)]> select version();
|
ERROR 2006 (HY000): MySQL server has gone away
|
No connection. Trying to reconnect...
|
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2)
|
ERROR: Can't connect to the server
|
root@darkstar:[Fri Jul 17 14:12:45][/var/lib/mysql]$ mysqladmin -p shutdown
|
Enter password:
|
root@darkstar:[Fri Jul 17 14:13:10][/var/lib/mysql]$ tail server_audit.log
|
20150717 14:10:42,darkstar,root,localhost,9,0,CONNECT,,,0
|
20150717 14:10:42,darkstar,root,localhost,9,219,QUERY,,'SHOW VARIABLES LIKE \'pid_file\'',0
|
20150717 14:10:42,darkstar,root,localhost,9,0,DISCONNECT,,,0
|
20150717 14:10:42,darkstar,root,localhost,8,0,DISCONNECT,,,0
|
20150717 14:12:58,darkstar,root,localhost,3,12,QUERY,,'set global server_audit_logging = 1',0
|
20150717 14:13:01,darkstar,root,localhost,3,13,QUERY,,'show global variables like \'%audit%\'',0
|
20150717 14:13:09,darkstar,root,localhost,4,0,CONNECT,,,0
|
20150717 14:13:09,darkstar,root,localhost,4,14,QUERY,,'SHOW VARIABLES LIKE \'pid_file\'',0
|
20150717 14:13:09,darkstar,root,localhost,4,0,DISCONNECT,,,0
|
20150717 14:13:09,darkstar,root,localhost,3,0,DISCONNECT,,,0
|
root@darkstar:[Fri Jul 17 14:13:14][/var/lib/mysql]$ mysqladmin -p shutdown
|
|
|
|
|
What if the shutdown was initiated by kill <pid>, which probably happens very often?