What if the shutdown was initiated by kill <pid>, which probably happens very often?
I don't ask for the impossible .. 
But the shutdown command seems to be omitted by the audit plugin. So from the security auditing point of view, it will be a good addition/feature of MariaDB.
my bad, in fact the MariaDB SHUTDOWN command is logged via the audit plugin , but the mysqladmin SHUTDOWN command is not logged :
5.5.44-MariaDB-log :
mysql root@darkstar:[Fri Jul 17 14:10:01 2015][(none)]> INSTALL PLUGIN SERVER_AUDIT SONAME 'server_audit.so';
|
Query OK, 0 rows affected (0.06 sec)
|
|
|
mysql root@darkstar:[Fri Jul 17 14:10:12 2015][(none)]> set global server_audit_logging = 1;
|
Query OK, 0 rows affected (0.01 sec)
|
mysql root@darkstar:[Fri Jul 17 14:12:58 2015][(none)]> show global variables like '%audit%';
|
+-------------------------------+-----------------------+
|
| Variable_name | Value |
|
+-------------------------------+-----------------------+
|
| server_audit_events | |
|
| server_audit_excl_users | |
|
| server_audit_file_path | server_audit.log |
|
| server_audit_file_rotate_now | OFF |
|
| server_audit_file_rotate_size | 1000000 |
|
| server_audit_file_rotations | 9 |
|
| server_audit_incl_users | |
|
| server_audit_logging | ON |
|
| server_audit_mode | 0 |
|
| server_audit_output_type | file |
|
| server_audit_query_log_limit | 1024 |
|
| server_audit_syslog_facility | LOG_USER |
|
| server_audit_syslog_ident | mysql-server_auditing |
|
| server_audit_syslog_info | |
|
| server_audit_syslog_priority | LOG_INFO |
|
+-------------------------------+-----------------------+
|
15 rows in set (0.00 sec)
|
|
|
mysql root@darkstar:[Fri Jul 17 14:13:01 2015][(none)]> select version();
|
ERROR 2006 (HY000): MySQL server has gone away
|
No connection. Trying to reconnect...
|
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2)
|
ERROR: Can't connect to the server
|
root@darkstar:[Fri Jul 17 14:12:45][/var/lib/mysql]$ mysqladmin -p shutdown
|
Enter password:
|
root@darkstar:[Fri Jul 17 14:13:10][/var/lib/mysql]$ tail server_audit.log
|
20150717 14:10:42,darkstar,root,localhost,9,0,CONNECT,,,0
|
20150717 14:10:42,darkstar,root,localhost,9,219,QUERY,,'SHOW VARIABLES LIKE \'pid_file\'',0
|
20150717 14:10:42,darkstar,root,localhost,9,0,DISCONNECT,,,0
|
20150717 14:10:42,darkstar,root,localhost,8,0,DISCONNECT,,,0
|
20150717 14:12:58,darkstar,root,localhost,3,12,QUERY,,'set global server_audit_logging = 1',0
|
20150717 14:13:01,darkstar,root,localhost,3,13,QUERY,,'show global variables like \'%audit%\'',0
|
20150717 14:13:09,darkstar,root,localhost,4,0,CONNECT,,,0
|
20150717 14:13:09,darkstar,root,localhost,4,14,QUERY,,'SHOW VARIABLES LIKE \'pid_file\'',0
|
20150717 14:13:09,darkstar,root,localhost,4,0,DISCONNECT,,,0
|
20150717 14:13:09,darkstar,root,localhost,3,0,DISCONNECT,,,0
|
root@darkstar:[Fri Jul 17 14:13:14][/var/lib/mysql]$ mysqladmin -p shutdown
|
|
|
|
|
serg, please review patch for this task.
serg, please review patch for this task.