This is a read-only copy of the MariaDB Knowledgebase generated on 2024-11-17. For the latest, interactive version please visit https://mariadb.com/kb/.

Audit plugin is loggin everything, despite the configuration parameters

My goal is to configure audit plugin with MariaDB with the forwarding of the auditing log entries to Syslog. This so far works. Unfortunately, I also want to limit the auditing log entries to just the queries which produced an error. I achieved the target of having only the queries logged setting the audit configuration variable 'server_audit_events' to 'QUERY'. This works, since now I can see in Syslog only the queries done in MySQL client, while the "CONNECT" and "DISCONNECT" actions are hidden. Unfortunately, I can see in Syslog ALL the queries, not only the queries which produced errors. Setting the audit configuration variable 'server_audit_syslog_priority' to 'LOG_WARNING' or 'LOG_ERR' didn't change the situation. My MariaDB version is '10.0.22'. The plugin configuration variables are shown below (*) Any help is welcomed.

Cheers, Teresa

--- (*)

MariaDB [(none)]> show global variables like 'server_audit%';
+-------------------------------+-----------------------+
| Variable_name                 | Value                 |
+-------------------------------+-----------------------+
| server_audit_events           | QUERY                 |
| server_audit_excl_users     |                       |
| server_audit_file_path        | server_audit.log      |
| server_audit_file_rotate_now  | OFF                   |
| server_audit_file_rotate_size | 1000000               |
| server_audit_file_rotations   | 9                     |
| server_audit_incl_users       |                       |
| server_audit_logging          | ON                    |
| server_audit_mode             | 0                     |
| server_audit_output_type      | syslog                |
| server_audit_query_log_limit  | 1024                  |
| server_audit_syslog_facility    | LOG_LOCAL6            |
| server_audit_syslog_ident     | mysql-server_auditing |
| server_audit_syslog_info       |                       |
| server_audit_syslog_priority  | LOG_WARNING           |
+-------------------------------+-----------------------+
15 rows in set (0.00 sec)

Answer Answered by Ian Gilfillan in this comment.

Wouldn't it make more sense to use the error log for this rather than the audit log? I don't think you can achieve what you want though the audit log.

Content reproduced on this site is the property of its respective owners, and this content is not reviewed in advance by MariaDB. The views, information and opinions expressed by this content do not necessarily represent those of MariaDB or any other party.