Hi, I am unable to find detailed documentation on mariadb regarding this, but from mysql[1] page it explains that aborted connections in logs should be happening only during certain cases which doesn't apply to our environment.

For each connection, closed gracefully we get entry like this with logging setting
[Warning] Aborted connection 2934 to db: 'unconnected' user: 'ABC' host: '127.0.0.1' (This connection closed normally)

Settings:
log_warnings 5
OS Ubuntu 20.04 latest updates
1:10.5.8+maria~focal

The question is if I am missing something here or this is expected from normal connection(different from mysql).

If this is normal logging then I would question whether this is useful and systematic. If intention is to allow some auditing then connectivity start and finish should be recorded alongside source port number as otherwise it is hard to identify among many connections from the same source IP.

Many thanks

[1] https://dev.mysql.com/doc/refman/5.7/en/communication-errors.html