[MDEV-5681] audit log will not rotate when the file size exceeds global variable setting Created: 2014-02-15  Updated: 2014-03-17  Resolved: 2014-03-17

Status: Closed
Project: MariaDB Server
Component/s: None
Affects Version/s: None
Fix Version/s: 5.5.37, 10.0.10

Type: Bug Priority: Major
Reporter: Adam C. Scott Assignee: Alexey Botchkov
Resolution: Fixed Votes: 0
Labels: plugins, server_audit
Environment:

RHEL 6.5, MariaDB 5.5.32, x86_64, server_audit-1.1.3


 Description   

audit log will not rotate when the file size exceeds global variable setting

Setting server_audit_file_rotate_now = ON does work though.

To reproduce, try setting server_audit_events = 'connect' and server_audit_file_rotate_size = 1000. Then connect with a bad password about 20 times:

for i in {1..20}; do mysql -ufail -pfail; done

Notice that the server_audit.log file does not rotate even though its size is 2700 bytes when the rotate size is 1000 bytes.

Same can be said about 2 more variables:
server_audit_file_rotations
server_audit_syslog_ident

We should fix them alltogether.

 Comments   
Comment by Adam C. Scott [ 2014-02-25 ]

After stepping through the debugger, the "bug" is that the server_audit_file_rotate_size will not take effect until after the log is closed and opened which can be achieved by:
set global server_audit_logging=OFF;
set global server_audit_logging=ON;

So this can provide a work around. In other words, after changing the server_audit_file_rotate_size, set logging off and then back on for the size to take effect.

Probably the best approach is to update this line in server_audit.c

static MYSQL_SYSVAR_ULONGLONG(file_rotate_size, file_rotate_size,
 
       PLUGIN_VAR_RQCMDARG, "Maximum size of the log to start the rotation.",
 
       NULL, NULL,
 
       1000000, 100, ((long long) 0x7FFFFFFFFFFFFFFFLL), 1);

and set the second NULL to a function that updates the global variable logfile in server_audit.c setting logfile->sizelimit = file_rotate_size

Comment by Alexey Botchkov [ 2014-03-14 ]

Fixing patch:
http://lists.askmonty.org/pipermail/commits/2014-March/006008.html

Generated at Thu Feb 08 07:06:14 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.