[MDEV-4764] Audit: With default server_audit_rotate=OFF the logs are still rotated Created: 2013-07-05  Updated: 2013-08-27  Resolved: 2013-08-27

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: None
Fix Version/s: None

Type: Bug Priority: Minor
Reporter: Elena Stepanova Assignee: Alexey Botchkov
Resolution: Fixed Votes: 0
Labels: server_audit

Issue Links:
Relates
relates to MDEV-4472 Auditing Plugin Closed

 Description   

I keep default values for rotation parameters:

| server_audit_rotate           | OFF          |
 
| server_audit_rotations        | 9            |

But the logs are still rotated at ~1000000 bytes:

-rw-rw---- 1 elenst elenst  263536 Jul  5 20:24 my_audit.log
 
-rw-rw---- 1 elenst elenst 1000190 Jul  5 20:23 my_audit.log.1
 
-rw-rw---- 1 elenst elenst 1000011 Jul  5 20:23 my_audit.log.2
 
-rw-rw---- 1 elenst elenst 1000013 Jul  5 20:23 my_audit.log.3
 
-rw-rw---- 1 elenst elenst 1000081 Jul  5 20:22 my_audit.log.4
 
-rw-rw---- 1 elenst elenst 1000022 Jul  5 20:22 my_audit.log.5
 
-rw-rw---- 1 elenst elenst 1000252 Jul  5 20:22 my_audit.log.6
 
-rw-rw---- 1 elenst elenst 1000162 Jul  5 20:21 my_audit.log.7
 
-rw-rw---- 1 elenst elenst 1000146 Jul  5 20:21 my_audit.log.8
 
-rw-rw---- 1 elenst elenst 1000016 Jul  5 20:21 my_audit.log.9

To my knowledge, I don't do anything to provoke this.

bzr version-info

revision-id: holyfoot@askmonty.org-20130704123621-gb3jvhyxdax6gpm9
 
revno: 3825
 
branch-nick: 5.5-noga-hf



 Comments   
Comment by Alexey Botchkov [ 2013-07-24 ]

It's not a bug.
The very 'server_audit_rotate' variable was made to let user to force log rotations by assigning any value to it.
Should it be done in more apparent way?

Comment by Elena Stepanova [ 2013-07-24 ]

>> Should it be done in more apparent way?

I think it should.
If you mean rotating at this exact moment, I'd expect FLUSH LOGS to do the trick (maybe we need FLUSH AUDIT LOGS or something).

In any case, there should be a way to turn off automatic log rotation, server_audit_rotate looks like the only viable candidate, and currently the value OFF is deceptive - I'm sure I have rotation turned off, and later I find out that my audit logs have been overridden due to the rotation algorithm which I didn't even set.

I suggest to keep it open for now and to check with whoever-makes-decisions-about-the-design.

Comment by Sergei Golubchik [ 2013-08-08 ]

What about renaming variables, to make them more consistent and self-documenting?

server_audit_file_path -> server_audit_file_path (no changes)
server_audit_file_rotate_size -> server_audit_file_rotate_size (no changes)
server_audit_rotations -> server_audit_file_rotations
server_audit_rotate -> server_audit_file_rotate_now or server_audit_file_flush with the variable being STRING (not BOOL) and the default value being empty string.

Comment by Alexey Botchkov [ 2013-08-22 ]

Variables renamed:
server_audit_rotations -> server_audit_file_rotations
server_audit_rotate -> server_audit_file_rotate_now with the variable being STRING (not BOOL)

Generated at Thu Feb 08 06:58:58 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.