[MDEV-4769] Audit: Non-query API commands produce empty QUERY events Created: 2013-07-07  Updated: 2013-08-27  Resolved: 2013-08-27

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: None
Fix Version/s: None

Type: Bug Priority: Minor
Reporter: Elena Stepanova Assignee: Alexey Botchkov
Resolution: Fixed Votes: 0
Labels: server_audit

Issue Links:
Relates
relates to MDEV-4472 Auditing Plugin Closed

 Description   

Non-query API function calls appear in the audit log as QUERY events with empty query text. I don't see how it can be helpful, but can easily flood the log; so we need to either make them meaningful, or to get rid of them.

The example below produces 2 such records, with mysql_list_fields(con,(const char*) "user",NullS) and mysql_close(con).

Test case:

#include <my_global.h>
 
#include <mysql.h>
 
 
 
 
 
int main(int argc, char **argv)
 
{  
  MYSQL *con = mysql_init(NULL);
 
 
 
  if (con == NULL) 
  {
 
      fprintf(stderr, "%s\n", mysql_error(con));
 
      exit(1);
 
  }
 
 
 
  if (mysql_real_connect(con, "127.0.0.1", "root", "", 
          "mysql", 0, NULL, 0) == NULL) 
  {
 
      fprintf(stderr, "%s\n", mysql_error(con));
 
      mysql_close(con);
 
      exit(1);
 
  }  
 
 
  mysql_list_fields(con,(const char*) "user",NullS);
 
  mysql_close(con);
 
 
 
  exit(0);
 
}

Audit log:

20130708 00:31:40,ubuntu12-04,root,localhost,52,CONNECT
 
20130708 00:31:40,ubuntu12-04,root[root] @ localhost [127.0.0.1],,52,QUERY,,0
 
20130708 00:31:40,ubuntu12-04,root[root] @ localhost [127.0.0.1],,52,QUERY,,0
 
20130708 00:31:40,ubuntu12-04,,,52,DISCONNECT

bzr version-info

revision-id: holyfoot@askmonty.org-20130705160101-ni574i35exft3wn5
 
revno: 3825
 
branch-nick: 5.5-noga-hf



 Comments   
Comment by Alexey Botchkov [ 2013-08-22 ]

Got rid of Non-query events in the log. (By now?)

Generated at Thu Feb 08 06:59:01 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.