[#MDEV-11510] Audit plugin sometimes causes server to crash when using with MySQL

The MariaDB audit plugin that's included in 10.1.19 (and probably also the recent 5.5 and 10.0 releases) can sometimes cause the server to crash when used with MySQL.

I have seen the following backtrace with MySQL 5.6.30:

03:27:40 UTC - mysqld got signal 11 ;

This could be because you hit a bug. It is also possible that this binary

or one of the libraries it was linked against is corrupt, improperly built,

or misconfigured. This error can also be caused by malfunctioning hardware.

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed,

something is definitely wrong and this may fail.

key_buffer_size=8388608

read_buffer_size=131072

max_used_connections=1

max_threads=151

thread_count=1

connection_count=1

It is possible that mysqld could use up to

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 68108 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x20c9530

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 7efd6c423e90 thread_stack 0x40000

/usr/sbin/mysqld(my_print_stacktrace+0x3b)[0x8e504b]

/usr/sbin/mysqld(handle_fatal_signal+0x491)[0x674761]

/lib64/libpthread.so.0(+0xf100)[0x7efd80cae100]

/usr/lib64/mysql/plugin/server_audit.so(auditing+0x4f4)[0x7efd7a590324]

/usr/sbin/mysqld[0x6a3105]

/usr/sbin/mysqld(_Z18mysql_audit_notifyP3THDjjz+0xba)[0x6a32fa]

/usr/sbin/mysqld[0x65db3c]

/usr/sbin/mysqld(_ZN6LOGGER11log_commandEP3THD19enum_server_commandPKcm+0x36)[0x661846]

/usr/sbin/mysqld(_Z17general_log_printP3THD19enum_server_commandPKcz+0x8b)[0x66193b]

/usr/sbin/mysqld(_Z16acl_authenticateP3THDj+0x2d3)[0x699ac3]

/usr/sbin/mysqld[0x6c34e3]

/usr/sbin/mysqld(_Z16login_connectionP3THD+0x3e)[0x6c441e]

/usr/sbin/mysqld(_Z22thd_prepare_connectionP3THD+0x24)[0x6c4a14]

/usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x12c)[0x6c4d2c]

/usr/sbin/mysqld(handle_one_connection+0x40)[0x6c4e10]

/usr/sbin/mysqld(pfs_spawn_thread+0x143)[0xb39433]

/lib64/libpthread.so.0(+0x7dc5)[0x7efd80ca6dc5]

/lib64/libc.so.6(clone+0x6d)[0x7efd7f96a1cd]

Another user reported the following backtrace on 5.7.15:

Thread pointer: 0x7f2624000fa0

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong…

stack_bottom = 7f263c4f5ea8 thread_stack 0x40000

/usr/local/mysql/bin/mysqld(my_print_stacktrace+0x35)[0xf1e045]

/usr/local/mysql/bin/mysqld(handle_fatal_signal+0x4a4)[0x79d404]

/lib64/libpthread.so.0(+0xf100)[0x7f266085d100]

/usr/local/mysql/lib/plugin/server_audit.so(auditing+0x4f4)[0x7f264409c324]

/usr/local/mysql/lib/plugin/server_audit.so(+0x940d)[0x7f264409f40d]

/usr/local/mysql/bin/mysqld(_Z18mysql_audit_notifyP3THD30mysql_event_general_subclass_tiPKcm+0x262)[0x79e032]

/usr/local/mysql/bin/mysqld(_ZN12Query_logger17general_log_printEP3THD19enum_server_commandPKcz+0xad)[0xc4267d]

/usr/local/mysql/bin/mysqld(_Z15acl_log_connectPKcS0_S0_S0_P3THD19enum_server_command+0xa5)[0x7a3e95]

/usr/local/mysql/bin/mysqld(_Z16acl_authenticateP3THD19enum_server_command+0xaa1)[0x7a5ec1]

/usr/local/mysql/bin/mysqld[0xcb8475]

/usr/local/mysql/bin/mysqld(_Z22thd_prepare_connectionP3THD+0x5e)[0xcb88de]

/usr/local/mysql/bin/mysqld(handle_connection+0x279)[0xdc5a39]

/usr/local/mysql/bin/mysqld(pfs_spawn_thread+0x174)[0x11d6ae4]

/lib64/libpthread.so.0(+0x7dc5)[0x7f2660855dc5]

/lib64/libc.so.6(clone+0x6d)[0x7f265f51dced]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0): is an invalid pointer

Connection ID (thread ID): 4

Status: NOT_KILLED

The plugin was installed in the following way:

Download the MariaDB tarball and put the plugin in the proper location:

$ wget https://downloads.mariadb.org/interstitial/mariadb-10.1.19/bintar-linux-x86_64/mariadb-10.1.19-linux-x86_64.tar.gz

$ tar -xzf mariadb-10.1.19-linux-x86_64.tar.gz

$ ls -l mariadb-10.1.19-linux-x86_64/lib/plugin/ | grep "audit"

-rwxr-xr-x 1 ec2-user ec2-user 176024 Nov 4 09:37 server_audit.so

$ sudo install mariadb-10.1.19-linux-x86_64/lib/plugin/server_audit.so /usr/lib64/mysql/plugin/

Then install the plugin in MySQL:

INSTALL PLUGIN server_audit SONAME 'server_audit.so';

Then enable it in the configuration file:

server_audit_logging=ON

server_audit_events=connect,query,table,query_ddl,query_dml,query_dcl

server_audit_excl_users=root

And restart the server:

sudo systemctl restart mysqld

[MDEV-11510] Audit plugin sometimes causes server to crash when using with MySQL Created: 2016-12-09 Updated: 2016-12-16 Resolved: 2016-12-16
Status:	Closed
Project:	MariaDB Server
Component/s:	Plugin - Audit
Affects Version/s:	10.1.19
Fix Version/s:	5.5.54

[MDEV-11510] Audit plugin sometimes causes server to crash when using with MySQL Created: 2016-12-09 Updated: 2016-12-16 Resolved: 2016-12-16