3

I was testing the "server_audit" plugin of MariaDB, which I configured like this:

plugin-load-add = server_audit
server_audit_logging = ON
server_audit_events = QUERY_DML
server_audit_output_type = FILE
server_audit_file_path = /path/to/audit.log
server_audit_query_log_limit = 1048576
server_audit_file_rotate_size = 1073741824
server_audit_file_rotations = 1

and I am currently running MariaDB 10.1.29 with MariaDB Audit Plugin version 1.4.3.

Based on the docs, the value QUERY_DML should be

Same as QUERY, but filters only DML-type queries (DO, CALL, LOAD DATA/XML, DELETE, INSERT, UPDATE, HANDLER and REPLACE statements)

emphasis mine.

After restarting the server, the log files has correctly been created, however it is logging also other queries, like for example plain SELECTs.

Is my configuration somewhat incorrect, or is it perhaps an error on MariaDB side?

6
  • It is very possible that SELECT is considered DML - though the documentation doesn't specify this, maybe because of an error. But the key here is "for example". Which other queries are logged? Mar 2, 2018 at 22:09
  • The other queries logged in the few tests I made were INSERTs and UPDATEs as expected.. I'd find it strange if SELECTs were considered data "manipulation" queries, since they do not change data, but it could be just me being ignorant. Mar 3, 2018 at 8:44
  • I agree with you about the definition of DML, but if the only "wrong" logged query is SELECT, I suppose that SELECT has been considered DML. You may want to report a bug stating that the actual behaviour is inconsistent with the documentation. Mar 3, 2018 at 12:58
  • 1
    I reported it as possible bug at jira.mariadb.org/browse/MDEV-15480, let see what is the response. Mar 6, 2018 at 10:32
  • Good. I subscribed to the bug, as I'm currently evaluating an auditing solution. Mar 6, 2018 at 10:37

1 Answer 1

3

As of version 1.4.4 of the plugin, there is now a QUERY_DML_NO_SELECT type that should give you what you are expecting.

Same as QUERY_DML, but doesn't log SELECT queries. (since version 1.4.4) (DO, CALL, LOAD DATA/XML, DELETE, INSERT, UPDATE, HANDLER and REPLACE statements)

This was introduced in MariaDB 5.5.42, MariaDB 10.0.17, and MariaDB 10.1.4.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.