We saw some unexpected queries from some database users we would like to identify, for example, preprod user is doing queries on our production databases but we do not know from where (we checked the codebase without any success). Before deleting the account, i would like to know what it is doing.
I took a look at mariadb general log (file format) but it looks like it does not log the mariadb username. Do you have a method to help us identify this ?
Thanks !
... preprod user is doing queries on our production databases ...
If your Security Policies say that preprod users are not allowed to run queries against production databases (which is a very Good Idea, BTW) then lock the account down immediately. No warning, no "Communications"; just do it.
Either way, you'll find out who/what was the source of the queries.
The general log does show the user running the queries, it's just that it's not shown on every line. Simply find the Id column of the line with the query in question, then look at lines before that to find the first line with that Id value which should have a Command equal to "Connect". The database user is then shown in the Argument column.
Alternatively, you can log to a table instead of a file. In that case, the user is shown for every row (column user_host).
