I was testing the "server_audit" plugin of MariaDB, which I configured like this:

plugin-load-add = server_audit
server_audit_logging = ON
server_audit_events = QUERY_DML
server_audit_output_type = FILE
server_audit_file_path = /path/to/audit.log
server_audit_query_log_limit = 1048576
server_audit_file_rotate_size = 1073741824
server_audit_file_rotations = 1

and I am currently running MariaDB 10.1.29 with MariaDB Audit Plugin version 1.4.3.

Based on the docs, the value QUERY_DML should be

Same as QUERY, but filters only DML-type queries (DO, CALL, LOAD DATA/XML, DELETE, INSERT, UPDATE, HANDLER and REPLACE statements)

emphasis mine.

After restarting the server, the log files has correctly been created, however it is logging also other queries, like for example plain SELECTs.

Is my configuration somewhat incorrect, or is it perhaps an error on MariaDB side?

  • It is very possible that SELECT is considered DML - though the documentation doesn't specify this, maybe because of an error. But the key here is "for example". Which other queries are logged? – Federico Razzoli Mar 2 at 22:09
  • The other queries logged in the few tests I made were INSERTs and UPDATEs as expected.. I'd find it strange if SELECTs were considered data "manipulation" queries, since they do not change data, but it could be just me being ignorant. – Matteo Tassinari Mar 3 at 8:44
  • I agree with you about the definition of DML, but if the only "wrong" logged query is SELECT, I suppose that SELECT has been considered DML. You may want to report a bug stating that the actual behaviour is inconsistent with the documentation. – Federico Razzoli Mar 3 at 12:58
  • 1
    I reported it as possible bug at jira.mariadb.org/browse/MDEV-15480, let see what is the response. – Matteo Tassinari Mar 6 at 10:32
  • Good. I subscribed to the bug, as I'm currently evaluating an auditing solution. – Federico Razzoli Mar 6 at 10:37
up vote 2 down vote accepted

As of version 1.4.4 of the plugin, there is now a QUERY_DML_NO_SELECT type that should give you what you are expecting.

Same as QUERY_DML, but doesn't log SELECT queries. (since version 1.4.4) (DO, CALL, LOAD DATA/XML, DELETE, INSERT, UPDATE, HANDLER and REPLACE statements)

This was introduced in MariaDB 5.5.42, MariaDB 10.0.17, and MariaDB 10.1.4.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.