[MDEV-8127] Unable to set the server_audit_file_path to any directory outside the data dir. Created: 2015-05-09  Updated: 2015-05-10  Resolved: 2015-05-10

Status: Closed
Project: MariaDB Server
Component/s: Plugin - Audit
Affects Version/s: 10.0.18
Fix Version/s: N/A

Type: Bug Priority: Minor
Reporter: Arunjith Assignee: Unassigned
Resolution: Not a Bug Votes: 0
Labels: None
Environment:

CentOS Linux release 7.0.1406


 Description   

Unable to set the server_audit_file_path to any directory outside the data dir. As per the variable status we are able to set the path to a different location, outside the data dir. But the logs are not physically created. Following are the details. 

#chown -R mysql.mysql /media
 

MariaDB [(none)]> SET GLOBAL server_audit_logging=OFF;
 
Query OK, 0 rows affected (0.00 sec)
 
MariaDB [(none)]> SET GLOBAL server_audit_file_path="/media/backups/audit/server_audit.log";
 
Query OK, 0 rows affected (0.00 sec)
 
 
 
MariaDB [(none)]> SET GLOBAL server_audit_logging=ON;
 
Query OK, 0 rows affected, 2 warnings (0.00 sec)
 
 
 
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE 'server_audit_file_path%';
 
+------------------------+---------------------------------------+
 
| Variable_name          | Value                                 |
 
+------------------------+---------------------------------------+
 
| server_audit_file_path | /media/backups/audit/server_audit.log |
 
+------------------------+---------------------------------------+
 
1 row in set (0.00 sec)
 
MariaDB [(none)]>  set global server_audit_file_rotate_now=ON;
 
Query OK, 0 rows affected (0.00 sec)
 

# ll /media/backups/audit/
 
total 0



 Comments   
Comment by Elena Stepanova [ 2015-05-09 ]

Please note that when you ran 

MariaDB [(none)]> SET GLOBAL server_audit_logging=ON;
 
Query OK, 0 rows affected, 2 warnings (0.00 sec)

you got 2 warnings. They are about not being able to create the file.

If you search for SELinux complaints, you'll find that it blocked the writing.
To make sure it's indeed so, you can set it temporarily to Permissive mode and make sure the log gets created.
It's not the best permanent solution though.
Here you can find some advice on how to deal with it:
https://mariadb.com/kb/en/mariadb/what-to-do-if-mariadb-doesnt-start/#selinux

If you still believe that MariaDB is doing something wrong in regard to SELinux policies, please let us know.

Generated at Thu Feb 08 07:24:50 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.